How to Set Up Log Rotation on a Linux Server

Left unchecked, log files grow indefinitely, eventually filling up disk space and potentially crashing services that depend on that storage. Setting up proper log rotation on a Linux server ensures logs stay useful for troubleshooting while automatically compressing, archiving, and deleting old entries before they become a problem.

Why Log Rotation Matters

Applications and system services constantly write to log files — web servers logging every request, authentication systems logging every login attempt, and countless background daemons recording their activity. Without rotation, these files can grow to gigabytes in size, consuming disk space, slowing down log searches, and in severe cases filling the disk entirely, which can cause cascading failures across other services.

What Is logrotate?

logrotate is the standard Linux utility for managing this process automatically. It runs on a schedule (typically daily via cron or a systemd timer) and handles rotating, compressing, and eventually deleting old log files based on rules you define, without requiring manual intervention.

Checking If logrotate Is Installed

Most Linux distributions include logrotate by default. Confirm it’s present:

logrotate --version

If missing, install it:

sudo apt install logrotate -y

Understanding the Configuration Structure

Global settings live in /etc/logrotate.conf, while individual application configs are stored as separate files in /etc/logrotate.d/. Most installed packages (Nginx, Apache, etc.) automatically drop their own configuration file here, so you often don’t need to write rules from scratch for common software.

Writing a Custom logrotate Configuration

For a custom application logging to /var/log/myapp/app.log, create a new file:

sudo nano /etc/logrotate.d/myapp

Add a configuration block like:

/var/log/myapp/app.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    create 0640 www-data www-data
}

Understanding Key Directives

• daily / weekly / monthly – how often rotation occurs
• rotate 14 – keep 14 rotated log files before deleting the oldest
• compress – gzip old logs to save disk space
• delaycompress – delays compression by one cycle, useful if another process still needs to read the most recent rotated file
• missingok – don’t throw an error if the log file doesn’t exist yet
• notifempty – skip rotation if the log file is empty
• create – define permissions and ownership for the new log file created after rotation

Testing Your Configuration

Before waiting for the next scheduled run, test your configuration manually:

sudo logrotate -d /etc/logrotate.d/myapp

The -d flag runs in debug mode, showing what would happen without actually rotating anything — a safe way to confirm your rules work as expected.

To force an actual rotation for testing purposes:

sudo logrotate -f /etc/logrotate.d/myapp

Handling Applications That Need a Restart Signal

Some applications keep a file handle open on their log file and need to be signaled after rotation to start writing to the new file. Add a postrotate script block for this:

postrotate
    systemctl reload myapp
endscript

Verifying Scheduled Execution

Confirm logrotate runs automatically via its systemd timer or cron entry:

systemctl list-timers | grep logrotate

Final Thoughts

Setting up proper log rotation on a Linux server is a small, one-time configuration task that prevents a surprisingly common cause of server problems: logs silently filling up disk space until something breaks. Whether you’re managing built-in system logs or a custom application, a few minutes spent configuring logrotate correctly saves you from discovering a full disk at the worst possible moment.