Configuring and managing logrotate on Linux

This article explains how logrotate works, which versions the main distributions use, and how to trigger rotation manually. Aimed at system administrators who want to keep log files under control.

REQUIREMENTS

- A Linux distribution with logrotate installed. Check with: `logrotate --version` - Root access or sudo rights to edit configuration files in `/etc/logrotate.d/` - Basic knowledge of the command line

STEPS

1. Check the installed version

Logrotate is present by default on most distributions. The version varies per system.

logrotate --version

Debian 13 (Trixie) and Arch Linux use version 3.22.0-1. Ubuntu 24.04 uses 3.19.0-1ubuntu1.1. NetBSD via pkgsrc has 3.21.0 for `sysutils/logrotate`.

2. Understand the configuration model

Logrotate reads configuration from `/etc/logrotate.conf` and `/etc/logrotate.d/`. The main configuration file contains global settings. The directory contains per-service configurations. Each file defines rotation for specific log files.

3. View an existing configuration

See what a standard configuration looks like:

cat /etc/logrotate.d/rsyslog

This shows rotation rules for system logs. You will see frequency (daily, weekly), rotation count (number of retained versions), and compression settings.

4. Create your own configuration

Create a configuration for an application. This example rotates `/var/log/mijnapp.log` weekly and keeps 4 versions:

sudo nano /etc/logrotate.d/mijnapp

/var/log/mijnapp.log {
    weekly
    rotate 4
    compress
    missingok
    notifempty
    create 0640 www-data adm
}

Explanation: `weekly` rotates every week, `rotate 4` keeps 4 old versions, `compress` packs them with gzip, `missingok` skips missing files, `notifempty` does not rotate empty logs, `create` makes a new log file with the specified permissions.

5. Test the configuration without actually rotating

Use the dry-run mode to find errors before actually rotating:

sudo logrotate -d /etc/logrotate.conf

This shows what logrotate would do without changing files. Check the output for error messages.

6. Force a rotation manually

Trigger rotation directly, regardless of the schedule:

sudo logrotate --force /etc/logrotate.conf

With `--force` you rotate all logs according to the configuration, even if the frequency has not been reached yet. Use this after modifying configurations to see the effect immediately.

7. Prevent concurrency issues with parallel runs

If you run logrotate manually while cron also runs it, use the state lock option:

sudo logrotate --skip-state-lock /etc/logrotate.conf

This prevents two processes from rotating the same logs at the same time. By default, logrotate locks its state file to prevent this.

8. Send logs by email

Configure email notification for rotated logs:

sudo logrotate --mail "beheer@voorbeeld.nl" /etc/logrotate.conf

This sends the content of rotated logs to the specified address. The `--mail` command overrides the default `mail` command. Note: this requires a working mail server on the system.

VERIFICATION

Check whether rotation works correctly:

sudo logrotate -v /etc/logrotate.conf

The `-v` flag shows detailed output of every action. For each log file, you will see whether rotation occurred, whether compression was performed, and which files were created.

Also check the state file:

cat /var/lib/logrotate/status

This shows the last rotation date per log file.

COMMON PROBLEMS

1. Logs are not rotated

Check whether the configuration in `/etc/logrotate.d/` is correct. Run a dry-run: `sudo logrotate -d /etc/logrotate.conf`. Check whether the state file already marks the rotation as performed. Remove the specific entry from `/var/lib/logrotate/status` and run again.

2. Logrotate does not run via cron

Check whether the cron job exists:

cat /etc/cron.daily/logrotate

If it is missing, reinstall logrotate or manually create a cron job that runs daily.

3. Permission errors during rotation

If you use `create`, the specified user must have access rights to the directory. Check with:

ls -la /var/log/mijnapp.log

Adjust the `create` rule to a user who has write rights on the log directory.

The development of logrotate remains active: the GitHub repository `logrotate/logrotate` shows a regular release pattern, with 3.22.0 as the latest version of June 1, 2024. The transition from older version control systems to Git, visible in the NetBSD package history, reflects how the project adapts to modern workflows. The question is not whether you need logrotate, but when you are going to configure it.