Log Rotation Basics
Server logs record many of the events on your server. They record /var/log/messages, which has information about named, ftpd and other services, as well as mysql, just to name a few things. When there’s a problem with your server and the cause is unclear, the server logs are a great place to start sleuthing.
But your server log files will not contain all of the information for your server forever. If they tried, file sizes would get unmanageable and disk space would fill up, eventually causing problems. For example, Apache logs will cause Apache to crash if they reach over 2 gigs. To prevent this, the server logs’ older information disappears into the abyss unless you rotate the logs.
Log rotation is a wonderful function that you are probably using already and don’t even know about. In fact, if you are using cPanel as your server control panel you are definitely using log rotation. (Plesk offers log rotation too, but it is not enabled by default.) Log rotation takes the current logs, compresses them and stores them elsewhere for later reference.
Configure Log Rotation Through cPanel/WHM
The easiest way to configure log rotation on a cPanel server is with the cPanel logd daemon. The logs that are rotated by this feature can be controlled by logging into WHM and going to Service Configuration and then cPanel Log Rotation Configuration. There is a nice long list of checkboxes for you to choose from, many of which are enabled by default. cPanel will rotate these logs and store them in /usr/local/cpanel/logs/archive/.
Configure Log Rotation in Plesk
Plesk also offers log rotation from their panel, however it requires a little more effort to enable and has fewer options. In Plesk, you will have to enable log rotation on a per domain basis by logging into the Plesk panel, going to Domains and choosing the domain you want to enable log rotation on, then clicking Websites & Domains, Show Advanced Operations and select Logs. If you want to do this across multiple domains you will need to repeat this process for each domain.
Configure Log Rotation the Command Line
The first way to configure log rotation on the command line is via the logrotate command. You must be logged into your server as root to configure logrotate.
Which logs are rotated are controlled by the logrotate configuration file and the directory /etc/logrotate.d/, the configuration file is located at /etc/logrotate.conf. You can make global settings in the logrotate.conf file, such as how frequently they run. You can also set up custom logs by adding a file to the /etc/logrotate.d/ directory. There are tons of options here from what you want rotated, how frequently you want them rotated, do you want them compressed, and even if you want them emailed to you.
To understand how a log rotate configuration file is written, let’s look at a section from the exim entry in /etc/logrotate.d/ directory:
create 0640 mailnull mail
/usr/bin/killall -HUP exim
The first line indicates the log that you want to rotate, in this case the exim_mainlog, located in /var/log.
The second line will create a new log file with the same name and as the rotated log. It will then change the ownership and permissions to what you have specified, in this example, 0640. It will immediately chmod, change the permissions to 0640, then “mailnull” and “mail” will change the ownership to user mailnull and group mail. (For more about permissions you can visit this techbench article.)
The third line zips the rotated log so that the archive takes up less space.
The next few lines control the behaviour that takes place after the log is rotated. All exim processes are killed, and the logrotate entry ends.
There is a great manual page that explains the logrotate command and will lead you through all your options to configure log rotate on the command line. It can be accessed on the command line by typing “man logrotate” or on the web here.
As you configure log rotation, you will need to be cognizant of disk space as you could potentially be piling up large stacks of logs on your server, but knowledge is power and in the hosting game knowledge is stored in logs.The Tech Bench is an ongoing blog series featuring the answers to common questions the ServInt MST fields everyday. You can also find more great tech tips in the ServInt KnowledgeBase.