logrotate Configuration: Taming Log File Growth on Linux

Introduction

Log files grow. That is their nature. Without proper management, a busy server can fill an entire disk with logs in days. logrotate is the standard Linux tool for managing log file rotation, compression, and cleanup. Despite its importance, it is often configured poorly or not at all. This post covers how to configure logrotate effectively for both system and application logs.

Environment

The examples use logrotate 3.21.0 on Ubuntu 22.04 LTS. The system runs several services generating logs in /var/log/ and custom application logs in /opt/myapp/logs/.

logrotate --version
# logrotate 3.21.0

Problem

Without logrotate configuration, log files grow indefinitely:

du -sh /var/log/*
# 12G     /var/log/journal
# 2.3G    /var/log/syslog
# 1.8G    /var/log/auth.log
# 450M    /var/log/nginx/access.log

Disk usage alerts start firing, and the system is at risk of running out of space.

Analysis

logrotate reads configuration files from:

1. /etc/logrotate.conf - Global settings
2. /etc/logrotate.d/ - Per-application configs (included from the main config)

The default configuration handles some system logs, but custom applications need explicit configuration. The key parameters are:

• daily/weekly/monthly: Rotation frequency
• rotate N: Keep N rotated files before deleting
• compress: Compress rotated files with gzip
• copytruncate: Copy then truncate (for applications that hold file handles)
• postrotate: Commands to run after rotation (usually signal the application)
• size: Rotate when file exceeds a size threshold

Solution

1. Configure logrotate for custom application logs

Create /etc/logrotate.d/myapp:

/opt/myapp/logs/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
    create 0640 appuser appgroup
    dateext
    dateformat -%Y%m%d
    size 100M
}

2. Configure for applications that need signal notification

For Nginx, which needs a signal to reopen log files:

/var/log/nginx/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid)
    endscript
}

3. Configure for syslog

/var/log/syslog {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

/var/log/mail.log {
    weekly
    rotate 12
    compress
    delaycompress
    missingok
    notifempty
    create 0640 syslog adm
}

4. Set up size-based rotation for high-volume logs

/var/log/myapp/access.log {
    size 50M
    rotate 10
    compress
    delaycompress
    copytruncate
    missingok
    notifempty
}

5. Test your configuration

Always test with --debug and --dry-run:

sudo logrotate --debug /etc/logrotate.d/myapp
# reading config file /etc/logrotate.d/myapp
# rotating pattern: /opt/myapp/logs/*.log 104857600 bytes (5 rotated files)
# empty log files are not rotated
# oldest log is still in use

sudo logrotate --dry-run --verbose /etc/logrotate.d/myapp

6. Force rotation for testing

sudo logrotate --force /etc/logrotate.d/myapp

7. Verify rotation occurred

ls -la /opt/myapp/logs/
# access.log
# access.log-20250420.gz
# access.log-20250419.gz
# access.log-20250418.gz

8. Handle log files with special permissions

/var/log/sensitive.log {
    daily
    rotate 7
    compress
    missingok
    notifempty
    create 0600 root root
    su root root
}

The su directive handles files owned by non-root users.

9. Schedule logrotate execution

logrotate is typically run by a daily cron job:

cat /etc/cron.daily/logrotate
#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf

For more frequent checks, create an hourly cron:

sudo nano /etc/cron.hourly/logrotate-check

#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf --state /var/lib/logrotate/hourly.state

Lessons Learned

logrotate is simple but requires testing. Always use --dry-run before deploying a new configuration, and always use copytruncate for applications that hold file handles unless they support log signal reopening. Keep delaycompress to give yourself a window to debug issues in recently rotated logs. And monitor your disk usage to catch misconfigurations before they cause outages.

---

This blog does not accept any external sponsorships, affiliate marketing, or ad revenue.