> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/homelab/managing-wireguard-logs-with-systemd-and-logrotate.md).

# Managing WireGuard Logs with Systemd and Logrotate 🔥

When managing a **VPN like WireGuard**, logging is crucial for **monitoring activity, debugging issues, and ensuring security**. But if left unchecked, logs can **grow rapidly** and become unmanageable.

In this guide, we’ll **set up Systemd** to capture WireGuard logs dynamically and use **Logrotate** to keep them under control automatically.

### Setup a Systemd file to store logs

**Step 1: Create a Systemd Service to Store Logs**

First, we need to create a Systemd service that continuously logs WireGuard activity.

🔹 Open a new Systemd service file:

```
nano /etc/systemd/system/wireguard-log.service
```

🔹 Add the following configuration:

```
[Unit]
Description=WireGuard Dynamic Debug Logging
After=network.target

[Service]
ExecStart=/bin/bash -c 'dmesg -wT | grep wireguard >> /var/log/wireguard-dyndbg.log'
Restart=always
RestartSec=5
StandardOutput=null
StandardError=null

[Install]
WantedBy=multi-user.target
```

🔹 Reload and restart Systemd to apply changes:

```
sudo systemctl daemon-reload
sudo systemctl restart wireguard-log.service
sudo systemctl enable wireguard-log.service
```

🔹 Verify that the service is running:

```
sudo systemctl status wireguard-log.service
```

### **Set Up Logrotate for Automatic Log Management**

Now, let’s ensure our logs don’t grow indefinitely by setting up **Logrotate**.

🔹 Install Logrotate (if not already installed):

```
sudo apt update && sudo apt install logrotate -y
```

🔹 Create a Logrotate configuration file:

```
nano /etc/logrotate.d/wireguard
```

🔹 Add the following configuration to manage log rotation:

```
/var/log/wireguard-dyndbg.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    create 0640 root root
    postrotate
        systemctl restart wireguard-log.service > /dev/null 2>&1 || true
    endscript
}

```

Test Your Log Rotation Setup

```
sudo logrotate -v /etc/logrotate.d/wireguard
```

To **force** log rotation manually:

```
sudo rm -f /var/lib/logrotate/status
sudo logrotate -f /etc/logrotate.d/wireguard
```

```
ls -lh /var/log/wireguard-dyndbg.log*
```