What is Logrotate?

Linux dedicated servers store logs in plain text files, often kept in the /var/log directory. The web server, for example, has a single file for the log, and as events are logged, they are appended to the end of the file, usually indicating the date and time of the event.

Over time, a log file could become very large, depending on the number and frequency of events. To manage this, logrotate is a program that moves current log files, compresses them, and then creates new empty logs to be filled again. This log rotation archives old logs so that your main file does not get too large.

For example, the system log “dmesg” will have archived logs named dmesg.1.gz, dmesg.2.gz, dmesg.3.gz and so on. In order for logrotate to routinely archive logs, most Linux distributions use cron jobs. The rotation can be performed on a daily, weekly, or monthly basis at a specified time, preferably during low traffic hours. You can also run logrotate manually, although this is rarely done unless there are problems that need troubleshooting.

Logrotate is free and comes with all Linux distributions. With it you can also perform more complex log management tasks. For more information, type man logrotate from the command line.