Skip to main content

Managing WireGuard Logs with Systemd and Logrotate

When managing a VPN like WireGuard, logging is crucial for monitoring activity, debugging issues, and ensuring security. But if left unchecked, logs can grow rapidly and become unmanageable.

In this guide, we’ll set up Systemd to capture WireGuard logs dynamically and use Logrotate to keep them under control automatically.

Setup a Systemd file to store logs

Step 1: Create a Systemd Service to Store Logs

First, we need to create a Systemd service that continuously logs WireGuard activity.

  • Open a new Systemd service file:
nano /etc/systemd/system/wireguard-log.service
  • Add the following configuration:
[Unit]
Description=WireGuard Dynamic Debug Logging
After=network.target

[Service]
ExecStart=/bin/bash -c 'dmesg -wT | grep wireguard >> /var/log/wireguard-dyndbg.log'
Restart=always
RestartSec=5
StandardOutput=null
StandardError=null

[Install]
WantedBy=multi-user.target
  • Reload and restart Systemd to apply changes:
sudo systemctl daemon-reload
sudo systemctl restart wireguard-log.service
sudo systemctl enable wireguard-log.service

or if you are ROOT then run without SUDO:

systemctl daemon-reload
systemctl restart wireguard-log.service
systemctl enable wireguard-log.service
  • Verify that the service is running:
sudo systemctl status wireguard-log.service

or if you are ROOT then run without SUDO:

systemctl status wireguard-log.service
Set Up Logrotate for Automatic Log Management

Now, let’s ensure our logs don’t grow indefinitely by setting up Logrotate.

  • Install Logrotate (if not already installed):
sudo apt update && sudo apt install logrotate -y

or if you are ROOT then run without SUDO:

apt update && apt install logrotate -y
  • Create a Logrotate configuration file:
nano /etc/logrotate.d/wireguard
  • Add the following configuration to manage log rotation:
/var/log/wireguard-dyndbg.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    create 0640 root root
    postrotate
        systemctl restart wireguard-log.service > /dev/null 2>&1 || true
    endscript
}
Test Your Log Rotation Setup
sudo logrotate -v /etc/logrotate.d/wireguard

or if you are ROOT then run without SUDO:

logrotate -v /etc/logrotate.d/wireguard

To force log rotation manually:

sudo rm -f /var/lib/logrotate/status
sudo logrotate -f /etc/logrotate.d/wireguard

or if you are ROOT then run without SUDO:

rm -f /var/lib/logrotate/status
logrotate -f /etc/logrotate.d/wireguard

Check your logs

ls -lh /var/log/wireguard-dyndbg.log*

Your DONE.

Ins0mniA


Back to top