The man page of logrotate has this sample configuration file:

   # sample logrotate configuration file

   /var/log/messages {
       rotate 5
           /usr/bin/killall -HUP syslogd

   "/var/log/httpd/access.log" /var/log/httpd/error.log {
       rotate 5
       mail www@my.org
       size 100k
           /usr/bin/killall -HUP httpd

   /var/log/news/news.crit {
       rotate 2
       olddir /var/log/news/old
           kill -HUP ‘cat /var/run/inn.pid‘

and explains the second set of directives as follows:

The next section defines the parameters for both /var/log/httpd/access.log and /var/log/httpd/error.log. They are rotated whenever it grows over 100k in size, and the old logs files are mailed (uncompressed) to www@my.org after going through 5 rotations, rather than being removed. The sharedscripts means that the postrotate script will only be run once (after the old logs have been compressed), not once for each log which is rotated. Note that the double quotes around the first filename at the beginning of this section allows logrotate to rotate logs with spaces in the name. Normal shell quoting rules apply, with ', ", and \ characters supported.

I look at that config file and see that there is a compress directive at the top. I therefore presume that the old logs on that section will already be compressed with gzip (error.log.5.gzip, access.log.5.gzip). Are they being decompressed prior to being emailed? Is there a way to just have them mailed without decompression?

  • I'm pretty sure it mails the log before compressing it (try and see), but are you sure you want to receive your Apache logs via e-mail? That could mean huge e-mails ... – Janne Pikkarainen May 5 '14 at 12:24
  • To have them after compression I'd suggest writing a script to do it and including it as a postrotate command. – Dan Pritts May 5 '14 at 17:43

The logs are compressed on the local filesystem, yes, and they are decompressed while being emailed, though it seems to do this with pipes instead of files (as in gunzip /var/log/httpd/error.log.5.gz | mail "/var/log/httpd/access.log /var/log/httpd/error.log" "www@my.org"). It can't email them prior to compression, as suggested by Janne Pikkarainen, because it's emailing the least recent log - which in this case is 5 days old. It also won't result in insanely huge emails (thanks to being triggered by size 100k instead of, say, daily), assuming you run logrotate regularly - say, hourly.

If you really want the compressed version of your logs emailed to you, Dan Pritts is correct - you'll need to create a script you can call using postrotate (or prerotate) instead of using the mail feature of logrotate itself. You'll want to send the compressed logs as attachments, and there are a number of ways to approach this, with varying levels of complexity and functionality - for more, see this question about sending attachments via command line on Stack Overflow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.