Logfilemanagement with Logrotate (Ubuntu)

This article has not been completed yet. However, it may already contain helpful information and therefore it has been published at this stage.

# Verify that logrotate is installed
logrotate --version

#  Check Loglocations, that have to be rotated
ls /var/log/remotelogs/

# Create a new Logrotate-Configuration File
sudo nano /etc/logrotate.d/rsyslog-remote

/var/log/remotelogs/**/*.log {
        daily
        su root adm
        maxsize 30G
        missingok
        create
        rotate 1
        compress
        sharedscripts
        prerotate
            invoke-rc.d rsyslog stop > /dev/null
        endscript
        postrotate
            invoke-rc.d rsyslog start > /dev/null
        endscript
}

• /var/log/remotelogs/**/: these two stars will match zero or more (sub-) directories
• /*.log: all files, that ends with ".log", will be processed
• daily: daily rotation. This overrides the weekly default
• su root adm: use the adm group to execute the rotation
• maxsize: once this file size has been reached, the rotation is initiated
• missingok: don’t write an error message if the log file is missing
• create: this creates a new empty log file after rotation
• rotate 1: keep one old log files. This overrides the rotate 4 default
• compress: compress the rotated files. this uses gzip by default and results in files ending in .gz
• sharedscripts: the prerotate or postrotate script are only executet for one time
• prerotate: executed before the log file is rotated
• endscript: this marks the end of the script area
• postrotate:  executed after the log file is rotated
• endscript: this marks the end of the script area

# Run Default Logrotate-Config
sudo logrotate /etc/logrotate.conf

# Run Default Logrotate-Config in Debug Mode (without any changes)
sudo logrotate /etc/logrotate.conf --debug

# Run Default Logrotate-Config in Verbose Mode (files, where no adjustment are necessary are skipped)
sudo logrotate /etc/logrotate.conf --verbose

# Run Default Logrotate-Config in Verbose \ Enforced Mode (all files are processed)
sudo logrotate /etc/logrotate.conf --verbose --force

References: