logrotate

rotates, compresses, etc system logs

logrotate [-d|--debug] [-v|--verbose] [-f|--force] [-s|--state file] config_file [ …]

Example:
sudo logrotate -v /etc/logrotate.d/rsyslog 2>&1 | sed --unbuffered '/Creating new state/d' |more

sudo service rsyslog restart ;
service rsyslog status|tail -n 10

Any process (including remote ones) can generate log file entries using logger.
logrotate manages logs by providing rotation, compression, removal and mailing of log files.
Logs are rotated periodically or when they grow large.

Run as a cron job,
Config files MUST have mode rw-r--r-- !
Multiple config files may be given on the command line, later options override.
A directory on the command line (example: /etc/logrotate.d causes all files in that directory to be used.

OPTIONS

Usage: logrotate [OPTION...] configfile
  -d, --debug               Don't do anything, just test (implies -v)
  -f, --force               Force file rotation
  -m, --mail=command        Command to send mail (instead of /usr/bin/mail)
  -s, --state=statefile     Path of state file
  -v, --verbose             Display messages during rotation

Help options:
  -?, --help                Show this help message
      --usage               Display brief usage message

Configuration file

Lines before the first filename set global options.
Local definitions override global ones and later definitions override earlier ones and specify logfiles to rotate.
N.B. Specifying a specific config files will not use global options from "master" config file.
No [TAB] characters permitted!

Example:

% cat /etc/logrotate.d/
# global options effect all files
       compress
        maxsize 100000
##### 
       /var/log/messages {
           rotate 5
           weekly
           postrotate
               /usr/bin/killall -HUP syslogd
           endscript
       }

       "/var/log/httpd/access.log" /var/log/httpd/error.log {
           rotate 5
           mail wwwadmin@my.org
           size 100k
           sharedscripts
           postrotate
               /usr/bin/killall -HUP httpd
           endscript
       }

       /var/log/news/* {
           monthly
           rotate 2
           olddir /var/log/news/old
           missingok
           postrotate
               kill -HUP `cat /var/run/inn.pid`
           endscript
           nocompress
       } 

/var/log/messages will go through five weekly rotations (a month plus 1 week).
 After it has been rotated (but before the old version has been compressed),
 /sbin/killall -HUP syslogd will be executed to wake up syslogd and get it to look around.

Both /var/log/httpd/access.log and /var/log/httpd/error.log are rotated when them grow over 100k ,
  the old logs files are mailed (uncompressed!) to wwwadmin@my.org after going through 5 rotations, rather than being removed.
With sharedscripts the postrotate script will only be run once (after the old logs have been compressed), not for each log.
Names may need to be enclosed in quotes

All files in /var/log/news are rotated on a monthly basis.
This is a single rotation directive and if errors occur for more than one file. The logs are not compressed.
If the directory /var/log/news does not exist, an error is reported which is not stopped with the missingok .

Use wildcards with caution. Specifingy *, will rotate all files, including previously rotated ones.
Use olddir or a more exact wildcard (such as *.log).

Options in Configuration

sudo logrotate -dv /etc/logrotate.d

Errors

In daemon.info due to [TAB]:
error: found error in file fff , skipping
error: found error in /var/log/lll.log , skipping
error: lll:1 bad rotation count '9}'
error: ffff:2 bad weekly directive ' maxsize 20k'

Logrotate requires configuration files in /etc/logrotate.d/ to be owned by root and not writable by others for security causing failures if managed by non-root users.
To use logrotate without root, run it with a custom state file (-s) and config file. Create custom config files in user-owned directory (e.g., /home/user/logrotate/) and run with:

logrotate -s /home/user/logrotate/status /home/user/logrotate/my.conf

Sudo Access: Allow a user to run specific logrotate commands via sudo.
Fixing Symlinks: Ensure symlinks point to files with proper root ownership.
Cron Setup: Set up a user-level cron job to trigger the local logrotate

FILES

/var/lib/logrotate/status dapie 9/24/13

logrotate state -- version 2
"/var/log/ConsoleKit/history" 2013-3-1
"/var/log/syslog" 2013-3-10
"/var/log/dpkg.log" 2013-7-10
"/var/log/auth.log" 2013-9-22
"/var/log/apt/term.log" 2013-3-1
"/var/log/mysql/mysql-slow.log" 2013-3-14
"/var/log/apt/history.log" 2013-3-1
"/var/log/samba/log.smbd" 2013-3-3
"/var/log/alternatives.log" 2013-7-10
"/var/log/debug" 2013-1-13
"/var/log/mail.log" 2013-1-6
"/var/log/kern.log" 2013-9-22
"/var/log/mysql.log" 2013-9-24
"/var/log/aptitude" 2013-1-6
"/var/log/apache2/access.log" 2013-3-14
"/var/log/wtmp" 2013-9-1
"/var/log/daemon.log" 2013-9-22
"/var/log/mail.warn" 2013-1-6
"/var/log/xdm.log" 2013-9-1
"/var/log/btmp" 2013-9-1
"/var/log/lpr.log" 2013-1-6
"/var/log/mail.err" 2013-1-6
"/var/log/mysql/mysql.log" 2013-3-14
"/var/log/samba/log.nmbd" 2013-3-6
"/var/log/user.log" 2013-9-22
"/var/log/mail.info" 2013-1-6
"/var/log/apache2/other_vhosts_access.log" 2013-3-14
"/var/log/apache2/error.log" 2013-3-14
"/var/log/cron.log" 2013-1-6
"/var/log/messages" 2013-1-13