logrotate - rotates, compresses, and mails any kind of logs

mail

logrotate

Flags

Flag Usage
-d debug mode : (implies -v : verbose mode) no changes will be made to the logs or to the state file
-f
force log rotation :
/usr/sbin/logrotate -f /etc/logrotate.d/serviceName; echo $?
If things don't work as expected (and since logrotate generates no logs), try this again with -d to view error messages :
/usr/sbin/logrotate -df /etc/logrotate.d/serviceName 2>&1 | grep error
with -d, log rotation is simulated.
-s stateFile
--state stateFile
  • To prevent parallel execution, logrotate acquires a lock on a state file (defaults to /var/lib/logrotate.status). If it cannot be acquired, logrotate will exit with value 3.
  • -s tells logrotate to use an alternate state file. This is useful if logrotate is being run as a different user for various sets of log files.

Configuration directives :

Directive Usage
compress compress old versions of logfiles with gzip
compresscmd /bin/bzip2 compress logs with /bin/bzip2 instead of the default gzip
Should be used with compressext, otherwise compressed files get a .gz extension.
compressext .bz2 give compressed files a .bz2 extension
copytruncate
To be used when the program writing into the logfile is not able to close and release it.
create a copy of the logfile, then truncate the original logfile.
There is a very small time slice between copying the file and truncating it, so some logging data might be lost.
create mode user group immediately after rotation (before the postrotate script is run), create a new logfile with :
  • the same name as the logfile just rotated
  • mode permissions
  • belonging to user:group
dateext when rotating logs, instead of appending numbers to successive rotations (from 1 (newest) to n (oldest)), append the log rotation date
  • default format : YYYYMMDD, customize it with dateformat
  • rotated logs are re-numbered at each rotation, but logs with dates are not renamed
  • if set as the default in /etc/logrotate.conf, this option can be disabled with nodateext in the service definition file
dateext can conflict with rotate if logrotate runs again on the same day (details)
ifempty rotate the log file even if it is empty (default value)
missingok don't issue an error if the log file is missing
notifempty do not rotate the log file when it is empty
olddir path/to/directory move logs into path/to/directory for rotation
  • path/to/directory
    • is assumed to be relative to the directory holding the logs unless an absolute path is specified
    • must be on the same physical device as the log file being rotated (except if : )
  • when not rotating logs as , don't forget to (source) :
    1. add the user rotating the logs to the log group
    2. let path/to/directory belong to the log group
rotate n rotate log files n times before removing them. In other words : keep n rotation intervals (days / weeks / months / ...) of logs.
this does not enforce n as the absolute maximum number of files within the log directory :
  • the current un-rotated log is counted separately
  • filenames not matching the expected rotated syntax (i.e. log number/date, compression extension, ) are ignored. These include :
    • files waiting for compression (i.e. missing the .gz extension)
    • those matching a previous naming convention : if logrotate was configured to simply number rotated log files, and the configuration was updated to enable dateext, then the serviceName.log.n files are ignored

Rotation intervals and conditions (source) :

daily
Each rotated file is listed in the state file (/var/lib/logrotate.status) with the date of its latest rotation. If current date > date in state file, the file is rotated (source).
weekly
logs are rotated if the current week day is lower than the week day of the last rotation (i.e. Monday is less than Friday) or if the last rotation occurred more than a week before the present
monthly
logs are rotated every month on the first day of the month that logrotate runs, which is often the first day of the month
yearly
logs are rotated when the current year differs from the date of the last rotation
size
logs are rotated based on their size rather than on a periodic schedule : size n[kMG]

Example

setup log rotation

To rotate logs (or any kind of file, such as .tar backups), you just have to :
  1. create a new configuration file with (don't forget the trailing EOF ) : 
    cat << EOF > /etc/logrotate.d/serviceName

    /path/to/serviceName/*log {
	daily
	rotate 10
	compress
	create 644 stuart admins
	missingok
	olddir /path/to/serviceName/rotatedLogs
	}
    EOF
    • you can list several patterns sharing the same log rotation specification :
      /var/log/tomcat8/catalina.out /var/log/tomcat8/*log {
		
		}
    • patterns like /var/log/tomcat8/*/*log are also supported
  2. Save and exit. Nothing to restart / reload

logrotate itself is fired by cron :

find /etc/cron* -name logrotate 
/etc/cron.d/logrotate
/etc/cron.daily/logrotate
On systemd-enabled machines, you'll find :
  • logrotate.service
  • which is triggered by logrotate.timer

get date of latest rotation (serverfault.com) :

grep serviceName /var/lib/logrotate/logrotate.status
Looks like the 1st rotation must wait at least 24 hours before being processed.

as : 
serviceName='cyberwatch_backup.logrotate'
rotatedFileName=$(awk '/{$/ { result=gensub(/^.*\/(.*)$/, "\\1", 1, $1); print result }' "/etc/logrotate.d/$serviceName")
grep "$rotatedFileName" /var/lib/logrotate/logrotate.status
"/backup/backup_cyberwatch.sql.gz" 2026-1-29-15:44:33