Log Rotation Basics

Server logs record many of the events on your server. They record /var/log/messages, which has information about named, ftpd and other services, as well as mysql, just to name a few things. When there’s a problem with your server and the cause is unclear, the server logs are a great place to start sleuthing.

But your server log files will not contain all of the information for your server forever. If they tried, file sizes would get unmanageable and disk space would fill up, eventually causing problems. For example, Apache logs will cause Apache to crash if they reach over 2 gigs. To prevent this, the server logs’ older information disappears into the abyss unless you rotate the logs.

Log rotation is a wonderful function that you are probably using already and don’t even know about. In fact, if you are using cPanel as your server control panel you are definitely using log rotation. (Plesk offers log rotation too, but it is not enabled by default.) Log rotation takes the current logs, compresses them and stores them elsewhere for later reference.

Configure Log Rotation Through cPanel/WHM

The easiest way to configure log rotation on a cPanel server is with the cPanel logd daemon. The logs that are rotated by this feature can be controlled by logging into WHM and going to Service Configuration and then cPanel Log Rotation Configuration. There is a nice long list of checkboxes for you to choose from, many of which are enabled by default. cPanel will rotate these logs and store them in /usr/local/cpanel/logs/archive/.

Configure Log Rotation in Plesk

Plesk also offers log rotation from their panel, however it requires a little more effort to enable and has fewer options. In Plesk, you will have to enable log rotation on a per domain basis by logging into the Plesk panel, going to Domains and choosing the domain you want to enable log rotation on, then clicking Websites & Domains, Show Advanced Operations and select Logs. If you want to do this across multiple domains you will need to repeat this process for each domain.

Configure Log Rotation the Command Line

The first way to configure log rotation on the command line is via the logrotate command. You must be logged into your server as root to configure logrotate.

Which logs are rotated are controlled by the logrotate configuration file and the directory /etc/logrotate.d/, the configuration file is located at /etc/logrotate.conf. You can make global settings in the logrotate.conf file, such as how frequently they run. You can also set up custom logs by adding a file to the /etc/logrotate.d/ directory. There are tons of options here from what you want rotated, how frequently you want them rotated, do you want them compressed, and even if you want them emailed to you.

To understand how a log rotate configuration file is written, let’s look at a section from the exim entry in /etc/logrotate.d/ directory:

/var/log/exim_mainlog {
create 0640 mailnull mail
/usr/bin/killall -HUP exim

The first line indicates the log that you want to rotate, in this case the exim_mainlog, located in /var/log.

The second line will create a new log file with the same name and as the rotated log. It will then change the ownership and permissions to what you have specified, in this example, 0640. It will immediately chmod, change the permissions to 0640, then “mailnull” and “mail” will change the ownership to user mailnull and group mail. (Click here for more information about permissions.)

The third line zips the rotated log so that the archive takes up less space.

The next few lines control the behavior that takes place after the log is rotated. All exim processes are killed, and the logrotate entry ends.

There is a great manual page that explains the logrotate command and will lead you through all your options to configure log rotate on the command line. It can be accessed on the command line by typing “man logrotate” or on the web here.

As you configure log rotation, you will need to be cognizant of disk space as you could potentially be piling up large stacks of logs on your server, but knowledge is power and in the hosting game knowledge is stored in logs.

Photo by xmodulo

Find out more about ServInt solutions

Starting at $25

  1. "When there's trouble on your server and the cause is unclear, server logs are a great place to start sleuthing."
  2. Want to see what's going on "under the hood" of your server? Rotate your server logs so you can check them later.
  3. [...] [...]
    How To: Log Rotation | Etterack /
  4. RT @servint: Are you rotating your server logs? Find out how in this week's #TechBench.
    servermanagedit /
  5. Are you rotating your server logs? Find out how in this week's #TechBench.
  • Hosting Advice
  • Computer World
  • Ars Technica

  • The New York Times
  • The Seattle Times
  • Bloomberg
  • The Hill

To engage with the ServInt Sales Team use the following chat icon. Normal sales hours are Monday-Friday 9am-5pm EST but feel free to leave a message and we will follow up as soon as possible.

Sales Chat

To engage with the ServInt Support Team you must be logged into our Customer Portal for identity verification and have a ticket opened about your request or there will only be limited support offered.

Support Chat