How to check if a log rotation is configured in Linux

Introduction

In this lab, you will learn how to check if log rotation is configured on a Linux system. Log rotation is a crucial process for managing log files, preventing them from consuming excessive disk space. You will explore the main logrotate configuration file, examine application-specific log rotation scripts, and use the logrotate -d command to inspect the status and simulate the log rotation process.

By following the steps in this lab, you will gain practical experience in verifying and understanding the log rotation setup on your Linux system, ensuring efficient log file management.

Skills Graph

%%%%{init: {'theme':'neutral'}}%%%% flowchart RL linux(("Linux")) -.-> linux/BasicFileOperationsGroup(["Basic File Operations"]) linux(("Linux")) -.-> linux/SystemInformationandMonitoringGroup(["System Information and Monitoring"]) linux(("Linux")) -.-> linux/UserandGroupManagementGroup(["User and Group Management"]) linux/BasicFileOperationsGroup -.-> linux/ls("Content Listing") linux/BasicFileOperationsGroup -.-> linux/cat("File Concatenating") linux/SystemInformationandMonitoringGroup -.-> linux/service("Service Managing") linux/UserandGroupManagementGroup -.-> linux/sudo("Privilege Granting") subgraph Lab Skills linux/ls -.-> lab-558731{{"How to check if a log rotation is configured in Linux"}} linux/cat -.-> lab-558731{{"How to check if a log rotation is configured in Linux"}} linux/service -.-> lab-558731{{"How to check if a log rotation is configured in Linux"}} linux/sudo -.-> lab-558731{{"How to check if a log rotation is configured in Linux"}} end

Check logrotate config with cat /etc/logrotate.conf

In this step, you will learn how to view the main configuration file for logrotate. logrotate is a utility designed to simplify the administration of log files on systems that generate a lot of log files. It allows for automatic rotation, compression, removal, and mailing of log files.

The main configuration file for logrotate is located at /etc/logrotate.conf. This file contains global settings and includes configurations for specific applications or services from the /etc/logrotate.d/ directory.

To view the contents of the main logrotate configuration file, you will use the cat command. The cat command is a standard Unix utility that reads files sequentially and writes them to the standard output.

Open your terminal if it's not already open. You can do this by clicking the Xfce Terminal icon on the left side of your desktop.

Now, type the following command into your terminal and press Enter:

cat /etc/logrotate.conf

This command will display the entire content of the /etc/logrotate.conf file directly in your terminal.

You will see output similar to this:

## see "man logrotate" for details

## rotate log files weekly
weekly

## use the syslog group by default, since this is the owning group
## of /var/log/syslog.
su root syslog

## keep 4 weeks worth of backlogs
rotate 4

## create new (empty) log files after rotating old ones
create

## uncomment this if you want your log files compressed
#compress

## packages drop log rotation information into this directory
include /etc/logrotate.d

## system-specific logs may be also be configured here.

This output shows the default settings for logrotate, such as rotating logs weekly (weekly), keeping 4 weeks of logs (rotate 4), and creating new log files after rotation (create). It also includes the line include /etc/logrotate.d, which tells logrotate to read additional configuration files from that directory.

Understanding the main configuration file is the first step to managing log rotation on a Linux system.

Click Continue to proceed to the next step.

Verify logrotate scripts in /etc/logrotate.d

In the previous step, you saw that the main logrotate.conf file includes configuration files from the /etc/logrotate.d/ directory. This directory is where individual applications and services place their specific logrotate configuration files.

Each file in /etc/logrotate.d/ typically contains instructions on how to rotate the log files for a particular program. This modular approach makes it easier to manage log rotation for many different services on a system.

To see which configuration files are present in this directory, you will use the ls command. The ls command lists the contents of a directory.

Type the following command into your terminal and press Enter:

ls /etc/logrotate.d/

This command will list all the files within the /etc/logrotate.d/ directory.

You will see a list of files, which may vary depending on the installed software on the system. It will look something like this:

apt  auth.log  dpkg  rsyslog

These filenames often correspond to the services or applications whose logs are being rotated (e.g., apt for the package manager, rsyslog for system logs).

To get a closer look at one of these configuration files, you can use the cat command again. For example, let's view the configuration for apt:

cat /etc/logrotate.d/apt

This will display the contents of the apt logrotate configuration file. You'll see specific directives for rotating the apt log files, such as which log files to rotate, how often, and how many old logs to keep.

By examining the files in /etc/logrotate.d/, you can understand how log rotation is configured for different services on your system.

Click Continue to move on to the next step.

Inspect logrotate status with logrotate -d

In this final step, you will learn how to use the logrotate command with the -d option to perform a "dry run". A dry run simulates the actions that logrotate would take without actually performing them. This is extremely useful for testing your logrotate configurations and understanding what will happen when logrotate runs for real.

The -d option stands for "debug" or "dry run". When you use it, logrotate will read its configuration files and report what it would do, but it won't modify any files or rotate any logs.

Since logrotate typically requires root privileges to access and modify log files in system directories like /var/log, you will need to use the sudo command to run logrotate with the necessary permissions. Remember, the labex user has sudo privileges without needing a password in this environment.

Type the following command into your terminal and press Enter:

sudo logrotate -d /etc/logrotate.conf

Let's break down this command:

sudo: Executes the command with superuser privileges.
logrotate: The command-line utility for managing log files.
-d: The option to perform a dry run (debug mode).
/etc/logrotate.conf: The main configuration file that logrotate should read.

The output of this command will be quite verbose. It will show you which log files logrotate is considering, which configuration directives apply to them, and whether rotation is necessary based on the current state and configuration.

You will see output detailing the processing of the main configuration file and the included files from /etc/logrotate.d/. It will indicate for each log file whether it needs rotating and why (e.g., size, age).

Example output might include lines like:

reading config file /etc/logrotate.conf
including /etc/logrotate.d
reading config file apt
...
rotating pattern: /var/log/apt/term.log /var/log/apt/history.log  weekly
...
considering log /var/log/apt/term.log
  log does not need rotating
considering log /var/log/apt/history.log
  log does not need rotating
...

This output confirms that logrotate read the configuration for apt and determined that its log files do not currently need rotation.

Using logrotate -d is a crucial step before deploying any new or modified logrotate configurations to ensure they work as expected without causing unintended issues with your log files.

You have now successfully inspected the main logrotate configuration, viewed the individual configuration files, and performed a dry run to see how logrotate would behave.

Click Continue to complete this lab.

Summary

In this lab, you learned how to check if log rotation is configured in Linux. You started by examining the main logrotate configuration file located at /etc/logrotate.conf using the cat command. This step showed you the global settings for log rotation, such as rotation frequency, retention period, and the inclusion of application-specific configurations from the /etc/logrotate.d directory.

Following the inspection of the main configuration, you would typically proceed to verify the individual logrotate scripts within the /etc/logrotate.d directory to understand how specific applications' logs are handled. Finally, you would inspect the logrotate status using the logrotate -d command to perform a dry run and see how log rotation would be executed without actually making changes, allowing you to confirm the configuration's effectiveness.