Console9

How to check Logrotate status

Check the Logrotate state file to verify that log rotation runs on schedule and confirm the last rotation timestamp for each log file.

Check the Logrotate state file to confirm that log rotation runs correctly and to see when each log file was last rotated.

Prerequisites

  • Linux system with Logrotate installed.
  • Read access to /var/lib/logrotate/status (root or sudo).

Step-by-Step: Check Logrotate Status

  1. View the Logrotate state file to see the last rotation timestamp for every configured log file:

    cat /var/lib/logrotate/status

    Logrotate stores one line per log file with the date of its last rotation. The output looks like:

    logrotate state -- version 2
"/var/log/nginx/access.log" 2026-3-7-0:0:0
"/var/log/nginx/error.log" 2026-3-7-0:0:0
"/var/log/syslog" 2026-3-8-0:0:0
"/var/log/auth.log" 2026-3-1-0:0:0

    Each entry shows the full path and the timestamp of the last rotation in YYYY-M-D-H:M:S format.

  2. Filter the Logrotate state file for a specific application log to check its rotation status:

    grep nginx /var/lib/logrotate/status

    Logrotate displays only lines matching the application name.

  3. Run Logrotate in debug mode to simulate rotation and verify that the configuration processes correctly:

    sudo logrotate -d /etc/logrotate.conf

    Logrotate prints the actions it would take without modifying any files. Review the output for errors or skipped files.

How to Verify Logrotate Status Check Was Successful

Logrotate state file entries with recent dates confirm that rotation runs on schedule. Compare the timestamps against the expected rotation frequency (daily, weekly, or monthly).

If a log file shows an old timestamp, the rotation schedule may be misconfigured. Run logrotate -d /etc/logrotate.d/{YOUR_APP} to debug that specific configuration.

Common Issues When Checking Logrotate Status

State file does not exist.Logrotate creates the state file after its first run. If /var/lib/logrotate/status is missing, Logrotate has never executed. Check that the cron job at /etc/cron.daily/logrotate exists or that the systemd timer logrotate.timer is active.

State file path differs between distributions.Some distributions store the state file at /var/lib/logrotate/logrotate.status or /var/lib/logrotate.status. Search for it with:

find /var/lib -name "*logrotate*status*"

Timestamps are stale.If all entries show old dates, the cron daemon (crond) may not be running. Check with systemctl status cron on Ubuntu or systemctl status crond on RHEL-based systems.

© 2026 - Console9