Log Rotation with Logrotate: Prevent Disk Overflow

Web servers, databases, and applications generate logs constantly. Without rotation, logs grow indefinitely and fill your disk, crashing your server. Logrotate automatically archives, compresses, and deletes old logs, keeping your VPS healthy and storage manageable.

Why Rotate Logs?

• Prevent disk overflow: A busy Nginx server can generate 100MB+ logs daily. Without rotation, you'll run out of disk in weeks
• Improve performance: Large log files slow down log viewing and searching
• Manage storage: Archive old logs to compressed files, freeing space
• Comply with regulations: HIPAA, PCI DSS require log retention policies
• Easy troubleshooting: Recent logs are manageable; older logs are archived

Logrotate Overview

What logrotate does:

• Watches log files (Nginx, Apache, MySQL, etc.)
• When file reaches size or age limit, rotate it
• Compress old logs (gzip by default, ~10% of original size)
• Delete logs older than retention period
• Restart services if needed (Nginx, Apache)
• Runs automatically via cron (usually daily)

Default location: /etc/logrotate.conf (main config) and /etc/logrotate.d/ (individual app configs)

Configure Logrotate

Check if logrotate is installed:

logrotate --version
# If not installed:
apt install logrotate   # Debian/Ubuntu
yum install logrotate   # CentOS/RHEL

Verify it's running:

cat /etc/cron.daily/logrotate
# Should show: /usr/sbin/logrotate /etc/logrotate.conf

Main Configuration

Edit /etc/logrotate.conf:

# Rotate daily
daily

# Keep 14 days of backups
rotate 14

# Create new log file after rotation
create

# Compress rotated logs (gzip)
compress

# Don't rotate if log is empty
notifempty

# Delay compression 1 day (allows app to read yesterday's log)
delaycompress

# Include app-specific configs
include /etc/logrotate.d

# Default permissions for new log files
create 0640 root adm

Rotation Options

Real-World Examples

Nginx (create /etc/logrotate.d/nginx):

/var/log/nginx/*.log {
    daily
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data www-data
    postrotate
        if [ -f /var/run/nginx.pid ]; then
            kill -USR1 `cat /var/run/nginx.pid`
        fi
    endscript
}

MySQL/MariaDB:

/var/log/mysql/error.log {
    weekly
    rotate 26
    compress
    delaycompress
    notifempty
    create 0640 mysql mysql
    postrotate
        systemctl reload mysql
    endscript
}

Application logs (by size):

/var/www/myapp/logs/*.log {
    size 100M
    rotate 10
    compress
    delaycompress
    notifempty
    create 0640 appuser appuser
}

Monitor Rotation

View logrotate history:

cat /var/lib/logrotate/status
# Shows last rotation time for each log file

Test configuration (dry run):

# Check for errors without rotating
logrotate -d /etc/logrotate.conf

# Force rotation (useful for testing)
sudo logrotate -f /etc/logrotate.conf

View rotated logs:

ls -lah /var/log/nginx/
# Shows: access.log, access.log.1, access.log.1.gz, access.log.2.gz, etc.

Troubleshooting

Logs not rotating?

# Check if logrotate ran
sudo logrotate -d /etc/logrotate.conf

# Check cron job
cat /etc/cron.daily/logrotate

# Force rotation
sudo logrotate -f /etc/logrotate.d/nginx

# View last run
cat /var/lib/logrotate/status

Logs taking too much space?

• Reduce rotate value (rotate 7 instead of rotate 14)
• Change frequency to weekly or monthly
• Enable delaycompress to compress immediately (not after 1 day)
• Set maxage 30 to delete logs older than 30 days

Application errors after rotation?

• Add postrotate/endscript to reload/restart service after rotation
• Nginx example: systemctl reload nginx
• Ensure app doesn't open file handles to old log files

Related: Syslog management | Package management | VPS management | Storage management

Related articles