Complete logrotate Guide — Automatic Log Rotation and Compression

What is logrotate?

When a server runs for a long time, log files under /var/log grow without bound. Left unchecked, the disk fills up and services stop; a multi-GB single log is hard even to search. logrotate is the standard tool that automates this: at a set interval or size it rotates logs into new files and compresses or deletes the old ones.

The basic idea of rotation looks like this.

app.log ←
app.log.1 ←
app.log.2.gz ←
app.log.3.gz
...

When a new file is created, the numbers shift by one, and the oldest file beyond the retention limit is deleted.

How it works and when it runs

logrotate is not a daemon; it is a one-shot command that cron or a systemd timer runs once a day.

# systemd check
systemctl list-timers logrotate.timer
systemctl status logrotate.timer

The configuration entry point is /etc/logrotate.conf, which ends with include /etc/logrotate.d to load per-app configs. The standard practice is to put package- or application-specific settings as files under /etc/logrotate.d/.

Global defaults — /etc/logrotate.conf

#
weekly

# 4 ( 4)
rotate 4

# after file
create

# file (app.log-20260618)
dateext

# file
compress

# settings
include /etc/logrotate.d

If an individual config under /etc/logrotate.d repeats the same directive, it overrides the global value.

Writing a per-app config — /etc/logrotate.d/myapp

A practical example for a web application log.

/var/log/myapp/*.log {
    daily
    rotate 14
    missingok
    notifempty
    compress
    delaycompress
    dateext
    create 0640 appuser appgroup
    sharedscripts
    postrotate
        systemctl reload myapp >/dev/null 2>&1 || true
    endscript
}

What each directive does:

When you need to unpack rotated .gz logs or bundle several logs for handoff, see Linux tar, gzip, and zstd decompression cheat sheet.

Size-based rotation

Use this when you want to cut by size rather than time.

/var/log/nginx/access.log {
    size 100M
    rotate 10
    compress
    missingok
    create 0640 www-data adm
    postrotate
 # nginx file
        [ -f /run/nginx.pid ] && kill -USR1 $(cat /run/nginx.pid)
    endscript
}

create vs copytruncate

These are the two most important rotation strategies. Choose based on how the application handles its log file.

/var/log/legacy-app/output.log {
    daily
    rotate 7
    compress
    copytruncate
}

prerotate / postrotate scripts

Run commands before or after rotation. The usual use is signaling a service to open the new file.

postrotate
 # systemd reload
    systemctl reload rsyslog >/dev/null 2>&1 || true
endscript

Without sharedscripts, the script runs once per file matched by the wildcard. A service reload usually needs to happen only once, so pairing it with sharedscripts is the common pattern.

Testing and debugging

After changing a config, verify immediately instead of waiting for cron.

# 1) ( X) —
logrotate --debug /etc/logrotate.d/myapp

# 2) (/ when)
sudo logrotate --force /etc/logrotate.d/myapp

# 3) settings run
sudo logrotate --force /etc/logrotate.conf

# 4) when check
cat /var/lib/logrotate/logrotate.status

Common problems

Recap

Because logrotate ships on almost every Linux server, getting into the habit of dropping a config file into /etc/logrotate.d/ whenever you deploy a new service is the most reliable way to prevent outages caused by a full disk.