🔄 logrotate

# View the global defaults
cat /etc/logrotate.conf

# View a package-installed config
cat /etc/logrotate.d/nginx
cat /etc/logrotate.d/syslog

Create /etc/logrotate.d/myapp for your application:

# /etc/logrotate.d/myapp
/var/log/myapp/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    create 0644 myapp myapp
    sharedscripts
    postrotate
        systemctl reload myapp 2>/dev/null || true
    endscript
}

# Time-based rotation (most common)
/var/log/myapp/app.log {
    daily       # rotate every day
    weekly      # or every week
    monthly     # or every month
    rotate 30   # keep 30 rotated files
}

# Size-based rotation -- rotate when file exceeds this size
/var/log/myapp/app.log {
    size 100M   # rotate when file reaches 100MB
    rotate 10
    compress
    missingok
}

# Size with minimum time -- rotate when BOTH conditions are met
/var/log/myapp/app.log {
    daily
    size 50M    # but only if also 50MB or larger
    rotate 7
    compress
}

# Date-stamped filenames instead of numbered
/var/log/myapp/app.log {
    daily
    rotate 30
    dateext               # app.log-20260425 instead of app.log.1
    dateformat -%Y%m%d    # format for the date suffix
    compress
}

delaycompress is one of the most commonly needed but least understood logrotate options. It prevents the JUST-rotated file from being compressed immediately:

# Without delaycompress:
# Day 1: app.log rotated to app.log.1, immediately compressed to app.log.1.gz
# Problem: if the app still has app.log.1 open, it writes to the compressed file
#          which corrupts it

# With delaycompress:
# Day 1: app.log rotated to app.log.1 (uncompressed)
#         App can still write to app.log.1 via its open file handle
# Day 2: app.log.1 compressed to app.log.1.gz (app has closed the handle by now)
#         app.log rotated to app.log.1 (uncompressed, for same reason)

/var/log/myapp/app.log {
    daily
    rotate 7
    compress
    delaycompress    # ALWAYS pair with compress
    missingok
    notifempty
    sharedscripts
    postrotate
        kill -USR1 $(cat /var/run/myapp.pid 2>/dev/null) 2>/dev/null || true
    endscript
}

Most daemons need to be told that their log file has been rotated so they open the new file. The postrotate script does this:

# Reload nginx after log rotation (nginx reopens logs on HUP)
/var/log/nginx/*.log {
    daily
    rotate 52
    compress
    delaycompress
    missingok
    notifempty
    sharedscripts
    postrotate
        nginx -s reopen 2>/dev/null || true
    endscript
}

# Reload Apache
/var/log/httpd/*log {
    daily
    rotate 52
    compress
    delaycompress
    missingok
    sharedscripts
    postrotate
        /bin/kill -USR1 $(cat /run/httpd/httpd.pid 2>/dev/null) 2>/dev/null || true
    endscript
}

# Reload rsyslog
/var/log/messages /var/log/secure /var/log/cron {
    weekly
    rotate 26
    compress
    delaycompress
    sharedscripts
    postrotate
        /usr/bin/systemctl kill -s HUP rsyslog.service 2>/dev/null || true
    endscript
}

# copytruncate -- alternative when you cannot signal the app
# Copies the log then truncates the original in place
# App keeps writing to same inode -- no signal needed
/var/log/myapp/app.log {
    daily
    rotate 7
    compress
    copytruncate    # use only when postrotate is not possible
}

# Dry run -- show what WOULD happen without doing it
sudo logrotate -d /etc/logrotate.d/myapp
sudo logrotate -d /etc/logrotate.conf

# Force rotation NOW regardless of schedule
sudo logrotate -f /etc/logrotate.d/myapp
sudo logrotate -f /etc/logrotate.conf    # force ALL logs

# Verbose output -- see exactly what logrotate is doing
sudo logrotate -v /etc/logrotate.d/myapp

# Combine: force + verbose (best for troubleshooting)
sudo logrotate -vf /etc/logrotate.d/myapp

# Debug mode (very verbose)
sudo logrotate -d -v /etc/logrotate.d/myapp

# Check when each log was last rotated
sudo cat /var/lib/logrotate/logrotate.status
sudo cat /var/lib/logrotate.status 2>/dev/null   # older RHEL path

# logrotate not running? Check the cron job
ls -la /etc/cron.daily/logrotate
cat /etc/cron.daily/logrotate

# Check systemd timer (newer systems)
systemctl status logrotate.timer
systemctl list-timers logrotate*

# Log file not rotating -- common causes:
# 1. Config syntax error
sudo logrotate -d /etc/logrotate.d/myapp 2>&1 | grep -i error

# 2. Not enough time has passed (check status file)
grep myapp /var/lib/logrotate/logrotate.status

# 3. File is empty (notifempty directive)
ls -la /var/log/myapp/app.log

# 4. Wrong permissions on config file (must not be world-writable)
ls -la /etc/logrotate.d/myapp
sudo chmod 644 /etc/logrotate.d/myapp

# 5. postrotate script failing
sudo logrotate -vf /etc/logrotate.d/myapp 2>&1 | tail -20

# Reset the status for a specific log (force fresh rotation)
sudo sed -i '/myapp/d' /var/lib/logrotate/logrotate.status

# /etc/logrotate.d/webapp -- production web application
/var/log/webapp/access.log
/var/log/webapp/error.log
/var/log/webapp/app.log {
    daily
    rotate 90
    compress
    delaycompress
    missingok
    notifempty
    dateext
    dateformat -%Y%m%d
    create 0640 webapp webapp
    sharedscripts
    prerotate
        if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
            run-parts /etc/logrotate.d/httpd-prerotate; \
        fi
    endscript
    postrotate
        systemctl reload webapp 2>/dev/null || true
        logger -t logrotate "webapp logs rotated"
    endscript
}

# /etc/logrotate.d/database-backup -- backup job logs
/var/log/db-backup.log {
    weekly
    rotate 52
    compress
    delaycompress
    missingok
    notifempty
    size 10M
    create 0640 root root
}

# /etc/logrotate.d/custom-app -- app that cannot be signaled
/var/log/legacy-app/output.log {
    daily
    rotate 30
    compress
    copytruncate
    missingok
    notifempty
    dateext
}