How do I setup OpenVPN to rotate logs?

Question

I would like to rotate my openvpn logs. How can I accomplish this?

Solution 1

Add the contents of the following to new file /etc/rsyslog.d/20-ovpn.conf. This makes sure that log events sent to rsyslog are handled nicely.

# Create a template for the vpn log location
$template OpenVPN,"/var/log/openvpn/ovpn.log"

# Save log events where the programname starts with ovpn like ovpn-server to the 
# location mentioned in the template
:programname, startswith, "ovpn-" -?OpenVPN

# Stop processing ovpn-* log events 
:programname, startswith, "ovpn-" ~

Run this command and make sure that there is no output.

grep ^log /etc/openvpn/server.conf

If this command outputs any lines, then your need to go into the config and comment out the log or log-append line. This will trigger the default logging that sends it to syslog.

Finally, create a new file /etc/logrotate.d/ovpn and add the contents below to that file. This will do a weekly rotation or rotate once a log file becomes 100M in size. It will keep 4 weeks and compress everything but that last two.

/var/log/openvpn/*.log {
        weekly
        size 100M
        rotate 4
        compress
        delaycompress
        missingok
        notifempty
        create 640 syslog adm
}

Restart the rsyslog and then openvpn services to make sure these new configs take. You should see /var/log/openvpn and /var/log/openvpn/ovpn.log get created immediately by rsyslog after openvpn restarts.

Solution 2

Looks like the example above uses legacy rsyslog syntax. The documentation says this would be the current syntax:

if $programname startswith 'ovpn-' then /var/log/openvpn/ovpn.log
& ~

I tested it and it works for me(TM).

Comments

[flickerfly]

Thanks, this will depend on what version of Ubuntu you are using. I believe it is valid for the latest LTS, but not previous unless you use a the rsyslog PPA. I do like the new syntax better.

[Josip Rodin]

Truth be told, I actually tested this on Debian 7, where rsyslog is 5.8.x. But that same series is on Ubuntu 12 LTS.

[Stéphane Chazelas]

Confirmed to work on 14.04

[artic sol]

I also added the program openvpn: ``` if $programname startswith 'openvpn' then /var/log/openvpn/ovpn.log & ~ ```