# How to configure Gaia OS to rotate a custom log file

**Product:** Multi-Domain Security Management, Security Gateways, Security Management  
**Version:** R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82.10  
**OS:** Gaia  
**Last Modified:** 2026-07-23

## Solution

You can configure Gaia OS to rotate a custom log file, like it does with the _/var/log/messages_ file.

**Configuration Procedure:**

1. Connect to the command line on the Gaia OS.
2. Log in to the Expert mode.
3. Back up the current file:
   
   `cp -v /etc/cpshell/log_rotation.conf{,_BKP}`
4. Edit the current file:
   
   `vi /etc/cpshell/log_rotation.conf`
5. At the end of the file, add a new line:
   
   _/<Full\_Path>/<Name\_of\_Log\_File>   <File\_Size\_in\_Bytes>   <Number\_of\_Rotated\_Files\_to\_Keep>_
   
   - For example:
     
     `/var/log/test.log   65536   20`
   - **You must use Spaces, and not Tabulations.**
6. Save the changes in the file and exit Vi editor.
7. Make sure your custom log file has the "write" permission:
   
   `chmod -v u+w,g+w /<Full_Path>/<Name_of_Log_File>`
8. Make sure Gaia OS can rotate your custom log file:
   
   `log_start list`

This output must show your custom log file.

**Troubleshooting:**

1. If Gaia OS does not rotate your custom log, examine the _/var/log/messages_ file - search for lines from the "`cp_log_switch`" process.
   
   Example from the _/var/log/messages_ file about a bad syntax in the _/etc/cpshell/log_rotation.conf_ file:
   
   `Sep 5 10:54:13 2016 Host cp_log_switch[1839]: Malformed configuration file line (47)`
2. Custom log rotation configured using Gaia OS does not apply to SAML-related log files or to UserCheck Portal log files, so these logs are not rotated automatically.
   
   This problem was fixed. The fix is included in:
   - [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 19
   - [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 103
   - [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 158

If you choose not to upgrade, Check Point can supply a **Hotfix**. [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**

Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

**Important Notes:**
- We do not recommend configuring the maximum file size to more than 10 MB (10485760 Bytes).
- During an upgrade, the _/etc/cpshell/log_rotation.conf_ file is replaced with a default file from the new version.  
  Before an upgrade, back up this file.  
  After the upgrade, edit this file again (do NOT restore the backup copy - you must manually make the required changes).
- The only environment variables supported in log_rotation.conf are:
  - $CPDIR
  - $FGDIR
  - $FWDIR
  - $NACPORTAL\_HOME (since R81.20)
  - $PPKDIR (since R81.10 Jumbo Hotfix Take 55)

#### NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version, and Symptoms. It may not work in other scenarios.