Logrotate

Logrotate is a log management utility that automates the rotation, compression, and deletion of log files on Linux systems.

What Logrotate Does and When to Use It

Logrotate manages log files that grow continuously on Linux servers. It rotates logs on a schedule, compresses old files, deletes aged copies, and optionally mails them to an administrator. Without Logrotate, log files grow until they fill the disk and cause service failures.

Logrotate reads its configuration from /etc/logrotate.conf and per-application files in /etc/logrotate.d/. A cron job or systemd timer triggers Logrotate once per day. Logrotate then checks each configured log file against its rotation rules and acts only when conditions are met.

Logrotate is not a logging daemon. It does not collect or write log files. Tools such as rsyslog, journald, and application-specific loggers handle log creation. Logrotate handles log lifecycle management after the files exist. For real-time log streaming or centralized log aggregation, use tools such as Filebeat, Fluentd, or Loki instead.

How to Install Logrotate

Most Linux distributions include Logrotate by default. Verify the installation by checking the version:

logrotate --version

If Logrotate is not installed, install it with the system package manager:

=== "Ubuntu / Debian"

sudo apt update && sudo apt install logrotate

=== "RHEL / CentOS / Fedora"

sudo dnf install logrotate

=== "Arch Linux"

sudo pacman -S logrotate

For detailed installation steps on Ubuntu, see How to install Logrotate on Ubuntu.

Core Concepts of Logrotate

Logrotate Configuration Files

Logrotate uses two configuration locations. The global configuration file /etc/logrotate.conf sets default directives for all log files. The /etc/logrotate.d/ directory holds per-application configuration files that override global defaults. Each application package (Nginx, Apache HTTP Server, MySQL) installs its own file in /etc/logrotate.d/.

Logrotate Rotation Schedule and Triggers

Logrotate supports time-based rotation with the daily, weekly, monthly, and yearly directives. Logrotate also supports size-based rotation with the size, minsize, and maxsize directives. The rotate directive controls how many old copies Logrotate keeps before deleting the oldest. A cron job in /etc/cron.daily/logrotate or a systemd timer triggers Logrotate once per day by default.

Logrotate Compression and Retention

Logrotate compresses rotated files with gzip by default when the compress directive is active. The delaycompress directive postpones compression until the next rotation cycle, which prevents conflicts with applications still writing to the previous log. The maxage directive removes rotated files older than a specified number of days.

Logrotate Postrotate and Prerotate Hooks

Logrotate executes shell scripts before and after rotation through prerotate/ endscript and postrotate/ endscript blocks. The postrotate hook commonly sends a reload signal to the application so it reopens its log file. The sharedscripts directive ensures the hook runs only once per rotation cycle rather than once per matched file.

Logrotate and Cron Integration

Logrotate relies on cron or systemd timers to run at scheduled intervals. Without a cron job, Logrotate does not execute automatically. The default cron job runs Logrotate once per day. For hourly rotation, create a custom cron job that invokes Logrotate with a separate configuration and state file.

Common Tasks with Logrotate

How to Check Logrotate Status

Logrotate records the last rotation timestamp for each log file in its state file. View the state file to confirm that rotation is running:

cat /var/lib/logrotate/status

For the full procedure, see How to check Logrotate status.

How to Force Log Rotation with Logrotate

Logrotate accepts the -f flag to force immediate rotation of all configured log files:

sudo logrotate -f /etc/logrotate.conf

How to Test Logrotate Configuration in Debug Mode

Logrotate runs in debug mode with the -d flag. Debug mode simulates rotation without changing any files:

sudo logrotate -d /etc/logrotate.conf

Logrotate Directives Reference

Logrotate accepts directives in its configuration files to control rotation behavior. For the complete list, see the Logrotate directives reference.

Logrotate Troubleshooting

Related Tools and Guides

Crontabcontrols the schedule that triggers Logrotate. See the Crontab articlefor cron expression syntax and scheduling options.

Nginxand Apache HTTP Server both install their own Logrotate configuration files in /etc/logrotate.d/. See the Nginx articlefor log management specific to Nginx.

For a guided walkthrough of Logrotate configuration, see the Logrotate tutorial: configure log rotation from scratch.