> Source: [sk113241](https://support.checkpoint.com/results/sk/sk113241)

# sk113241 - How to configure Gaia OS to rotate a custom log file

| Property | Value |
|----------|-------|
| Solution ID | sk113241 |
| Date Created | 2016-09-09 |
| Last Modified | 2026-07-23 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R81.20, R81.10 (EOS), R82.10, R81.20, R82.10, R81 (EOS), R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20 |
| OS | Gaia |

## Solution

You can configure Gaia OS to rotate a custom log file, like it does with the */var/log/messages* file.

**Configuration Procedure:**

1. Connect to the command line on the Gaia OS.
2. Log in to the Expert mode.
3. Back up the current file:  
   `cp -v /etc/cpshell/log_rotation.conf{,_BKP}`
4. Edit the current file:  
   `vi /etc/cpshell/log_rotation.conf`
5. At the end of the file, add a new line:   
   */\<Full_Path\>/\<Name_of_Log_File\> \<File_Size_in_Bytes\> \<Number_of_Rotated_Files_to_Keep\>*   
   * For example:  
     `/var/log/test.log 65536 20`
   * **You must use Spaces, and not Tabulations.**
6. Save the changes in the file and exit Vi editor.
7. Make sure your custom log file has the "write" permission:  
   `chmod -v u+w,g+w /<Full_Path>/<Name_of_Log_File>`
8. Make sure Gaia OS can rotate your custom log file:   
   `log_start list`  
   This output must show your custom log file.

**Troubleshooting:**

1. If Gaia OS does not rotate your custom log, examine the */var/log/messages* file - search for lines from the "`cp_log_switch`" process.

Example from the */var/log/messages* file about a bad syntax in the */etc/cpshell/log_rotation.conf* file:   
`Sep 5 10:54:13 2016 Host cp_log_switch[1839]: Malformed configuration file line (47)`
2. Custom log rotation configured using Gaia OS does not apply to SAML-related log files or to UserCheck Portal log files, so these logs are not rotated automatically.

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 19
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 103
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 158

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).
**Important Notes:**   

* We do not recommend to configure the maximum file size to more than 10 MB (10485760 Bytes).
* During an upgrade, the */etc/cpshell/log_rotation.conf* file is replaced with a default file from the new version.   
  Before an upgrade, back up this file.  
  After the upgrade, edit this file again (do NOT restore the backup copy - you must manually make the required changes).
* The only environment variables supported in log_rotation.conf are:
  * $CPDIR
  * $FGDIR
  * $FWDIR
  * $NACPORTAL_HOME (since R81.20)
  * $PPKDIR (since R81.10 Jumbo Hotfix Take 55)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content