logrotate Cheat Sheet

Sidebar

Linux · logrotate Cheat Sheet

Keeping log files from filling the disk. Options and directives were checked against the upstream logrotate manual page; logrotate itself was not run here (no Linux machine to hand), so check logrotate --version and man logrotate on yours, and use -d first. The paths shown are the usual Debian/Ubuntu and RHEL ones.

The Big Picture

/etc/logrotate.confMain config: global defaults plus an include of logrotate.d
/etc/logrotate.d/One small file per application (nginx, apache2, your own)
/var/lib/logrotate.statusState file: when each log was last rotated
logrotate.timerRuns it daily on systemd distros (older ones use cron.daily)
systemctl list-timers logrotate.timerSee when it last ran and runs next
it is not a daemonIt runs, rotates what is due, and exits

Command Line

logrotate -d fileDebug: dry run, changes nothing, prints what it would do
logrotate -f fileForce rotation now, even if not due
logrotate -v fileVerbose: say what it is doing
logrotate -s state fileUse a different state file (handy for testing)
logrotate -l log fileWrite the verbose output to a file
logrotate --versionCheck which version you have
sudo logrotate /etc/logrotate.confRun everything by hand, as the timer would

A Typical Config

/var/log/myapp/*.log {Which logs (globs allowed), then a block in braces
dailyHow often
rotate 14Keep 14 old logs, delete older
compressGzip the old logs
delaycompressLeave the newest old log uncompressed
missingokNo error if the log is not there
notifemptyDo not rotate an empty log
create 0640 www-data admNew empty log with this mode, owner, group
}End of block

When to Rotate

hourlyNeeds logrotate itself to be run hourly (cron or timer)
daily weekly monthly yearlyTime-based rotation
size 100MRotate when over this size (k, M, G): ignores the time rules
maxsize 100MRotate when over this size even before the time is up
minsize 1MRotate only if over this size AND the time is up
minage 3Skip logs younger than 3 days
maxage 30Delete rotated logs older than 30 days (checked when rotating)

Keeping & Naming

rotate NOld logs kept; 0 deletes them, -1 keeps them (use maxage)
dateextapp.log-20270317, not app.log.1
dateformat -%Y-%m-%dOwn date format (%Y %m %d %H %M %S and a few more)
extension .logKeep the extension: app.1.log
olddir /var/log/oldKeep old logs in another folder (same disk)
createolddir 0755 root rootMake that folder if missing
start 0First number to use (app.log.0)

Compression

compress / nocompressCompress old logs or not
delaycompressWait one cycle; needs compress. Use if the app keeps writing to the old file
compresscmd /usr/bin/xzDifferent compressor
compressext .xzMatching extension
compressoptions -9Options for the compressor

The File Is Still Open

createDefault way: rename the log, make a new one, tell the app to reopen
postrotate … endscriptCommands to run after rotating (e.g. reload the service)
copytruncateCopy the log, then empty the original: for apps that cannot reopen
sharedscriptsRun the script once for all logs matched, not once each
prerotate / firstactionRun before one log / before any log
lastaction / preremoveRun after all logs / before a log is deleted

Safety & Ownership

su www-data admRotate as this user and group, not root
missingokDo not fail when the log is absent
ifempty / notifemptyRotate empty logs / skip them
include /etc/logrotate.dRead more config; must not be group/world-writable
allowhardlinkRotate files with more than one hard link (off by default)
shredOverwrite deleted logs with shred -u

Recipes

logrotate -d /etc/logrotate.d/myappTest a new config safely before trusting it
logrotate -fv /etc/logrotate.d/myappForce one rotation and watch it happen
grep myapp /var/lib/logrotate.statusWhen did it last rotate this log?
ls -l /var/log/myapp/Check the result: .1, .2.gz and so on
size 50M + rotate 5 + compressCap a busy log at about 50M plus 5 old ones
systemctl status logrotateDid the last scheduled run succeed?
The #1 trap: test with -d, and mind the open file
Run logrotate -d before you trust a new config: it shows what would happen and changes nothing. And remember that renaming a log does not make the program stop writing to it: without a postrotate reload or copytruncate, the app keeps writing into the renamed file and the new one stays empty. Also, a log directory writable by a non-root user makes logrotate complain about "insecure permissions": add a su user group line.