logrotate — the rotation policy · Linux

logrotate runs (typically) daily via cron or a systemd timer, rotating text log files so they do not grow without bound. A misconfigured logrotate produces two failure modes: the disk fills with old logs, or the rotation breaks the application because it does not know to reopen the file.

Reading a logrotate config

Read-only / Safelogrotate nginx— Daily rotation. Keep 14 days. Compress (with one-day delay so the most recent rotated file is uncompressed for fast access). Create new empty files with mode 0640 owned by www-data:adm. The postrotate sends SIGUSR1 to the nginx master — nginx's signal to reopen log files.

$ cat /etc/logrotate.d/nginx

/var/log/nginx/*.log {
daily
missingok
rotate 14
compress
delaycompress
notifempty
create 0640 www-data adm
sharedscripts
postrotate
[ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid)
endscript
}

Illustrative output

The directives

Directive	Meaning
`daily` / `weekly` / `monthly` / `yearly`	Rotation cadence
`size 100M`	Rotate when the file exceeds this size
`rotate N`	Keep N rotated files before deleting
`compress`	gzip rotated files
`delaycompress`	Skip compression on the most recent rotation; compress on the next
`nocompress`	Never compress
`missingok`	Skip if the file does not exist (no error)
`notifempty`	Skip if the file is empty
`ifempty`	Force rotation even if empty
`create MODE OWNER GROUP`	Create a new empty file with these attributes after rotation
`nocreate`	Do not create a new file — the application must create one
`copytruncate`	Truncate the original file in place after copying; use for applications that cannot be told to reopen
`sharedscripts`	Run postrotate once for all matched files (not once per file)
`postrotate` … `endscript`	Command to run after rotation
`prerotate` … `endscript`	Command to run before rotation

Read-only / Safelogrotate --debug— --debug shows what logrotate would do without actually rotating. Use this to validate a new configuration: see which files match, what actions would be taken, and whether any errors would occur.

$ logrotate --debug /etc/logrotate.d/nginx 2>&1 | head -10

reading config file /etc/logrotate.d/nginx
Considering log file: /var/log/nginx/access.log
log file /var/log/nginx/access.log is empty, not rotating
Considering log file: /var/log/nginx/error.log
log file /var/log/nginx/error.log is empty, not rotating
...

Illustrative output

copytruncate — the application-friendly rotation

Read-only / Safecopytruncate— copytruncate tells logrotate to copy the log file to a rotated name, then truncate the original in place. This works for applications that keep the file descriptor open and would otherwise keep writing to the rotated (and renamed) file. The cost: a brief moment where log lines may be lost between the copy and the truncate.

$ cat /etc/logrotate.d/myapp

/var/log/myapp/*.log {
daily
rotate 7
compress
copytruncate
missingok
notifempty
}

Illustrative output

Common logrotate bugs

Bug	Symptom
Missing `postrotate` for an app that holds file descriptors open	Application writes to the rotated file; old log is gone, new file is empty
Missing `create` directive	New empty file does not exist after rotation; application may fail to log
`copytruncate` without sufficient disk space for the copy	Rotation fails; log file grows unbounded
Missing `delaycompress` and the application reads the latest rotated file	Application opens a compressed file it cannot read
`rotate 0`	Log file is deleted after rotation — no retention

Read-only / Safedry run— logrotate -d /etc/logrotate.conf runs in dry-run mode across the entire configuration. Review before enabling — especially the postrotate actions, which can fail if a service is not running.

$ logrotate -d /etc/logrotate.conf 2>&1 | tail -10

reading config file /etc/logrotate.conf
... considering /var/log/myapp/access.log
... rotating, keeping 7, compressing
... considering /var/log/myapp/error.log
... rotating, keeping 7, compressing
... considering /var/log/wtmp
... not rotating (no logs to rotate)

Illustrative output

Adding rotation for a custom log

sudo tee /etc/logrotate.d/myapp <<'EOF'
/var/log/myapp/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    create 0640 myapp myapp
    sharedscripts
    postrotate
        /usr/bin/systemctl reload myapp.service > /dev/null 2>&1 || true
    endscript
}
EOF

logrotate --debug /etc/logrotate.d/myapp

This rotates myapp’s logs daily, keeps 14 days, compresses with a one-day delay, creates a new file with the correct ownership, and reloads the service so it reopens the log file descriptor.

Reading a logrotate config

The directives

copytruncate — the application-friendly rotation

Common logrotate bugs

Adding rotation for a custom log

Knowledge check