How to Rotate Apache Log Files in Linux

by Ramesh Natarajan on July 22, 2011

Question: I would like to automatically rotate the apache access_log and error_log files. Can you explain with an example on how to do this?

Answer: This can be achived using logrotate utility as explained below.

Add the following file to /etc/logrotate.d directory.

# vi /etc/logrotate.d/apache
/usr/local/apache2/logs/access_log /usr/local/apache2/logs/error_log {
    size 100M
    compress
    dateext
    maxage 30
    postrotate
      /usr/bin/killall -HUP httpd
      ls -ltr /usr/local/apache2/logs | mail -s "$HOSTNAME: Apache restarted and log files rotated" ramesh@thegeekstuff.com
    endscript
}

Note: Refer to our logrotate tutorial (with 15 examples) that explains more details about how to use logrotate options.

In the above /etc/logrotate.d/apache example:

  • size 100M – Once the access_log, and error_log reaches 100M, it will be rotated. You can also use 100k (for Kb), 100G (for GB). Instead of size, you can also rotate apache logs using frequency (daily, weekly, monthly).
  • compress – Indicates that the rotated log file will be compressed. By default this uses gzip. So, the rotated file will have .gz extension.
  • dateext - Appends the date in YYYYMMDD format to the rotated log files. i.e Instead of access_log.1.gz, it creates access_log-20110616.gz
  • maxage - Indicates how long the rotated log files should be kept. In this example, it will be kept for 30 days.
  • postrotate and endscript – Any commands enclosed between these two parameter will be executed after the log is rotated.

Important: Once you rotate the log files, you want apache to write the new log messages to the newly created access_log and error_log. So, you need to send the HUP signal to the apache as shown here. Make sure to do /usr/bin/killall -HUP httpd, which will restart the apache after rotating the log files (Read more about kill).

Also, you might want to send an email to yourself indicating that the log file is rotated, along with the output of ls -ltr command as the body of the email. i.e Add the following between “postrotate” and “endscript” option (after the killall command).

ls -ltr /usr/local/apache2/logs | mail -s "$HOSTNAME: Apache restarted and log files rotated" ramesh@thegeekstuff.com

The /etc/cron.daily/logrotate script runs everyday that will perform log rotate of all the files as specified in the /etc/logrotate.conf and all the file under /etc/logrotate.d directory.

After adding the above /etc/logrotate.d/apache file, for testing purpose, you can manually call the logrotate script as shown below.

# /etc/cron.daily/logrotate

Once the log files are rotated, do a ls to verify them. As we explained above, the rotated log files will be kept for 30 days.

# ls /usr/local/apache2/logs
access_log
error_log
access_log-20110716.gz
error_log-20110716.gz

Linux Sysadmin Course Linux provides several powerful administrative tools and utilities which will help you to manage your systems effectively. If you don’t know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linux system administrator.
Get the Linux Sysadmin Course Now!

If you enjoyed this article, you might also like..

  1. 50 Linux Sysadmin Tutorials
  2. 50 Most Frequently Used Linux Commands (With Examples)
  3. Top 25 Best Linux Performance Monitoring and Debugging Tools
  4. Mommy, I found it! – 15 Practical Linux Find Command Examples
  5. Linux 101 Hacks 2nd Edition eBook Linux 101 Hacks Book

Bash 101 Hacks Book Sed and Awk 101 Hacks Book Nagios Core 3 Book Vim 101 Hacks Book

{ 7 comments… read them below or add one }

1 ChristianS July 22, 2011 at 12:41 am

Why don’t you just use piped logs with /usr/sbin/rotatelogs which is part of the httpd-package (at least on RHEL & Co.)?

See http://httpd.apache.org/docs/2.2/logs.html#piped

2 Keith July 22, 2011 at 2:34 am

Thanks for the article, but I thought most distros did this automatically these days? Fairly sure my Debian Lenny and Squeeze servers do this.

3 Yogesh July 22, 2011 at 5:56 am

@Keith
This is useful with compiled version of Apache installation.
The RPM version however gets autorotate.

4 akalata February 1, 2012 at 9:41 am

Thanks for the info, and sorry about the auto-email you got as I was setting this up — might want to use a placeholder address for people who copy/paste without really reviewing all the code.

5 Justin September 13, 2013 at 2:01 am

killall does not seem like a very good way to restart apache…

6 Dionysius October 15, 2013 at 7:14 am

Confirm. Do NOT use killall -HUP for apache, see here.

7 hussain September 24, 2014 at 1:26 am

nice article

/usr/bin/killall -HUP httpd

apache2 in the place of httpd
in case of compiled httpd through source

Leave a Comment

Previous post:

Next post: