Logrotate's main configuration file is generally located in /etc/logrotate.conf. This file's format is defined by the manpage for logrotate. In a nutshell, the format is as follows:
<global configuration options>
<definition for logfile 1>
<definition for logfile 2>
<definition for logfile 3>
... etc ...
Let's take a look at an example logrotate.conf file and examine what we could set:
weekly
rotate 4
create
#compress
Here, we are specifying a weekly log rotation; we want to keep 4 weeks worth of logs, and we want to create blank new logs after rotating the old ones. We also have and option "compress" commented out. If we wished to compress our old log files, we would uncomment this section. This is, in fact, the default setting under Debian.
Let's take a look at another example for the global section:
size 100K
start 0
nocopytruncate
Here, we are specifying that we want to rotate logs once they reach 100K in size; we want the rotated logs to start with the numbering "0" instead of "1"; and we want to not truncate the original log file in place after copying it.
Next, we will typically find an include:
# packages drop log rotation information into this directory
include /etc/logrotate.d
After this, we may find additional rules and scripting for log files. However, because of this include, there is actually a better place to put these.
/etc/logrotate.d
Inside this directory you will find other files which logrotate will include in its configuration when it is run. Note that this may be a security concern, as logrotate runs as root, if this directory is not well protected!
Let's take a look at what we might expect to find in this directory:
Here, we are specifying how to rotate the Apache logs. They default (under Debian) to weekly rotates. They keep 52 old log files. They compress the old logs, but that decompression is delayed until the next rotate cycle. They do not rotate the logs if they are empty. They also define an external script to run when the rotation has completed (50 imaginary points to whomever can tell me what it's doing).