logrotate

Trigger a run manually

$ logrotate [path/to/logrotate.conf] --force

$ logrotate [path/to/logrotate.conf] --mail [/usr/bin/mail_command]

$ logrotate [path/to/logrotate.conf] --state /dev/null

$ logrotate [path/to/logrotate.conf] --skip-state-lock

$ logrotate [path/to/logrotate.conf] --log [path/to/log_file]

logrotate [option...] config_file

Common options include:
-d (--debug)
-f (--force)
-v (--verbose)
-s <statefile> (--state <statefile>)
-l <logfile> (--log <logfile>)

-d, --debug
    Enables debug mode. No actual changes are made to log files or the state file; logrotate only prints what it would do.

-f, --force
    Forces log rotation, even if logrotate determines it's not necessary (e.g., not enough time has passed or size threshold not met).

-v, --verbose
    Displays detailed messages about what logrotate is doing, including log file names, rotation actions, and errors.

-s statefile, --state statefile
    Uses an alternative state file instead of the default (/var/lib/logrotate/status). This file keeps track of when each log was last rotated.

-l logfile, --log logfile
    Writes its own verbose output to the specified log file instead of standard output.

-m command, --mail-command command
    Specifies the command to use when mailing rotated logs. Overrides the compiled-in default or the one specified in the configuration.

-o directive=value, --option directive=value
    Overrides a configuration directive with the given value. This allows for temporary modifications without changing the configuration file.

logrotate is a powerful utility designed to manage system log files automatically. It prevents log files from consuming excessive disk space and makes them easier to manage by systematically archiving or deleting old logs. It operates by rotating log files based on criteria like size or time. When a log file is rotated, the current log is moved (e.g., mylog.log becomes mylog.log.1), a new empty log file is created, and older rotated logs might be compressed or deleted. This process is typically invoked daily via a cron job. Its behavior is highly configurable through a main configuration file (/etc/logrotate.conf) and additional application-specific configuration files (/etc/logrotate.d/), allowing administrators to define specific rotation policies for different log sets, including frequency, number of old logs to keep, compression options, and post-rotation script execution.

While logrotate automates log management, careful configuration is essential. Misconfigurations can lead to disk space exhaustion (if logs are not rotated or too many are kept), loss of critical log data (if rotated too aggressively or deleted prematurely), or permission issues. It typically relies on a cron job (usually daily) to run; if cron is not functioning, logrotate will not execute. Ensure log files have correct permissions for logrotate to read and write them.

Logrotate's behavior is controlled by configuration files. The main configuration is at /etc/logrotate.conf. This file often includes other configuration files from the /etc/logrotate.d/ directory, allowing individual applications or services to define their own log rotation rules (e.g., apache2, nginx, syslog). Each configuration block can specify rules like rotation frequency (daily, weekly, monthly), log retention count, compression, and post-rotation commands.

Logrotate uses a state file, typically located at /var/lib/logrotate/status, to keep track of when each log file was last rotated. This file is crucial for logrotate to determine if a log needs rotation based on its configured frequency or size. It's a simple plain-text file that logrotate updates after each successful rotation.

Before automated tools, system administrators manually managed ever-growing log files, a tedious and error-prone process. The need for an efficient, automated solution led to the development of utilities like logrotate. It became a standard component in Unix-like operating systems, addressing the critical challenge of preventing disk space exhaustion by managing logs and ensuring system stability. Its design allows for highly flexible configuration, adapting to diverse logging needs across various applications and services.

cron(8), syslogd(8), rsyslogd(8), journalctl(1)