Front | Info | Lists | Newsfeeds | Study Guide | What is BSD?
Advertisement: The OpenBSD PF Packet Filter Book: PF for NetBSD, FreeBSD, DragonFly and OpenBSD

BSD Links
·New Links
·User Groups

This is the BSDA Study Guide Book written via a wiki collaboration. This is a work in progress. You may contribute to or discuss this specific page at

Configure log rotations


Understand that the system automatically maintains many different logs. Be able to configure log rotation by either time or size.


The newsyslog tool is used to backup log files and then create new empty log files. (TODO Footnote: System logging is covered in section Configure system logging.) It can compress log files and remove old log files. By default, the BSD systems run "newsyslog" once every hour via cron. (The cron scheduler is covered in section Configure an action to be scheduled by cron(8).) It can rotate logs when they reach a certain size or at a certain time (within an hour). And it can optionally send a signal to a daemon after moving and creating a new log file.

TODO: explain "rotated" or "rotation"

Note that the newsyslog(8) implementations vary by BSD.

The newsyslog configuration is at /etc/newsyslog.conf. The following is an example configuration:

# logfilename      [owner:group] mode count size when  flags [/pid_file] [sig_num]
/var/log/cron       root:wheel   600  3     100  *     Z
/var/log/lpd-errs                644  7     10   *     Z
/var/log/maillog                 640  7     *    @T00  Z
/var/log/messages                644  5     100  *     Z
/var/log/wtmp                    644  3     *    @01T05 B

TODO: explain the above. Count is the number of generations. TODO: show examples of results (short directory listing)


The following newsyslog example rotates a log file under a home directory. It rotates the file whenever it gets to at least 500 Kilobytes and keeps the most recent 52 compressed archives. newsyslog creates a new log file owned by root (and doesn't add any log entry to it), and then sends a USR1 signal to the process found in the listed PID file.

# logfilename      [owner:group] mode count size when  flags [/pid_file] [sig_num]
/home/foo/logs/access.log  root: 644  52    500  *     bz   /var/run/  USR1

Practice Exercises

More information

newsyslog(8), newsyslog.conf(5), syslog.conf(5)

Front | Information | Lists | Newsfeeds