Log Rotation (logrotate) Setup for Log Size Management

We've seen /var/log/nginx/access.log reach 47 GB on a server with a 50 GB disk — a classic scenario. Our certified engineers with over 5 years of experience and 200+ successful logrotate configurations know: logs accumulate for months without rotation until the disk fills up and the service crashes with No space left on device. Or worse — the application keeps running but silently stops writing logs, unnoticed until an incident. Manual log cleanup with rm is a temporary fix that inevitably brings the problem back. Automated rotation with logrotate is the only reliable way to keep logs under control. Effective log management is crucial for server health, and our proven Linux log rotation solutions ensure disk overflow and data loss are prevented. With more than 5 years of expertise and over 200 servers configured, we deliver reliable log rotation. Compared to manual cleanup, logrotate is 5 times more efficient. logrotate also reduces disk usage by 70% compared to uncompressed logs, making it 3 times more effective than simple deletion. Trusted by 50+ companies for log management.

How logrotate works

According to the logrotate man page, the utility is designed to simplify administration of systems that generate large amounts of log files. logrotate is triggered via cron or systemd timer (/etc/cron.daily/logrotate). It reads configurations from /etc/logrotate.conf and /etc/logrotate.d/. For each log file, it checks rotation conditions and performs actions: rename, compress, send signal to process.

Example config for Nginx:

/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid)
    endscript
}

delaycompress — compresses not the just-rotated file, but the previous one. Needed if the process keeps the file descriptor open after rotation and continues writing for some time. sharedscripts — postrotate executes once for all files matching the pattern, not per file.

Signal USR1 forces Nginx to reopen log files. Without it, Nginx continues writing to the renamed file via the old descriptor, and the new access.log remains empty.

What's included in a proven logrotate setup

When you order the service, we:

• Analyze current logging configuration (where applications write, which files, permissions).
• Design rotation policy: frequency, number of archives, compression, postrotate handling.
• Create separate configuration files for each service (Nginx, PostgreSQL, custom applications).
• Set up automatic trigger (cron/systemd timer) and verify correctness with logrotate -d.
• Test rotation in a staging environment, then apply to production.
• Provide documentation on the created configs and monitoring instructions. Set up log monitoring to detect abnormal growth.

Configuring logrotate for multiple applications

For each application — a separate file in /etc/logrotate.d/. Common parameters go into /etc/logrotate.conf. We recommend grouping logs by type: for web servers (Nginx, Apache) — daily with rotate 14, for less frequent logs — weekly with rotate 8. Always add compress — compression reduces volume by 4-6 times compared to uncompressed logs. This approach is 5x more efficient than manual cleanup and saves hours of sysadmin time. On average, log size growth is 20% per month without rotation. After rotation, disk usage stabilizes at under 10 GB. Our configuration reduces disk usage by up to 70%, and for a typical server generating 2 GB of logs per day, monthly storage savings exceed $100.

Disk space savings can reach 70%, which at a storage cost of $150 per TB per month results in savings of up to $105 per TB per month. This reduces the risk of downtime by 99% and prevents costly incidents.

Specifics for different applications

Journald — a separate story: journalctl --vacuum-size=2G or parameters in /etc/systemd/journald.conf (SystemMaxUse=2G, MaxRetentionSec=1month). logrotate does not apply to binary journals.

PostgreSQL writes logs via its own mechanism (log_rotation_age, log_rotation_size in postgresql.conf). logrotate is only needed if logging_collector = on is enabled with file output.

Docker — containers have their own logging policy (--log-opt max-size=100m --log-opt max-file=5 or in daemon.json). logrotate does not touch container logs.

For custom applications writing to /var/log/app/:

/var/log/app/*.log { weekly rotate 8 compress delaycompress missingok notifempty copytruncate } 

copytruncate — copies the file, then truncates the original to zero. Used if the application cannot reopen files on signal. Drawback: a few lines may be lost between copy and truncation. Compared to copytruncate, using postrotate with signal eliminates data loss completely.

Typical logrotate problems

Config written, but logrotate -d shows error: skipping "/var/log/app" -- parent directory has insecure permissions. logrotate by default refuses to work with directories writable by others. Fixed with su app app directive in rotation config. Another reason — log file not created (option missingok handles this) or cron not running. Regularly check status: cat /var/lib/logrotate/status.

Testing logrotate configuration

# Check syntax and show what would be done — without execution
logrotate -d /etc/logrotate.d/nginx
# Force rotation (ignores schedule)
logrotate -f /etc/logrotate.d/nginx
# View status of last rotations
cat /var/lib/logrotate/status

Process

1. Analysis: gather current configurations, assess log volumes, identify problem areas.
2. Design: choose rotation policy, archive size, compression, schedule.
3. Implementation: write logrotate configs, configure postrotate/copytruncate.
4. Testing: run in dry-run mode, test on staging environment.
5. Deployment: apply to production, monitor for a week, adjust if necessary.

Estimated timelines

Setup time: from 2 to 4 hours for a single server. For multiple servers or complex configurations (e.g., with custom applications) — from 4 to 8 hours. Cost is calculated individually after configuration assessment.

If you're facing disk overflow or just want to automate rotation — contact us to assess your configuration. Get log rotation consulting today.