Fixing Logrotate: Troubleshooting Automatic Log Rotation

Nov 6, 2025 by Andrew McMorgan 57 views

Logrotate Won't Rotate Your Logs Automatically? Here's the Fix!

Hey Plastik Magazine readers! Ever scratched your head wondering, "logrotate won't rotate my logs automatically"? You're definitely not alone. It's a common headache for Debian users, and I'm here to walk you through the troubleshooting steps. Let's dive in and get those logs rotating like they should! We'll cover everything from the basics of logrotate to the nitty-gritty of debugging why it might be failing on your system. Whether you're a seasoned sysadmin or just starting out, this guide will provide the insights you need. We'll examine the core configuration files, the execution process, and the potential pitfalls that can prevent logrotate from doing its job. By the end, you'll be equipped with the knowledge to diagnose and resolve any log rotation issues you encounter. So, grab a coffee (or your preferred beverage) and let's get started on this exciting journey into the world of log management!

Understanding the Logrotate Basics

Alright, before we get into the weeds, let's make sure we're all on the same page. Logrotate is your trusty sidekick for managing log files on Linux systems. Its main purpose is to automatically rotate, compress, and remove log files, preventing them from consuming all your disk space. This is super important because logs can grow rapidly, and without proper management, you could run into all sorts of problems. Think of it as a digital janitor, keeping things tidy and efficient. It works based on configurations you define, telling it how often to rotate logs, how many old logs to keep, and how to handle them (like compressing them). The core of logrotate's functionality lies in its configuration files, typically located in /etc/logrotate.conf and /etc/logrotate.d/. These files contain instructions on how to handle specific log files or groups of log files. Understanding these configurations is key to troubleshooting any issues you might encounter. We'll get into the details of these files later, but for now, just remember that they are the brains of the operation. Logrotate runs periodically, usually via a cron job, to check these configurations and perform the rotation tasks. The frequency of this cron job is also important, as it determines how often logrotate checks for log rotation needs. So, if you're experiencing problems, the first thing to check is whether the cron job is running as expected. And of course, we'll cover how to verify this and more in the following sections.

Key Logrotate Components

Let's break down the main components you should know. First, there's the configuration file, /etc/logrotate.conf. This file contains global settings that apply to all log files managed by logrotate. You'll find options like the frequency of rotation, the compression method, and the directory where logrotate looks for additional configuration files. Second, there's the /etc/logrotate.d/ directory. This directory houses individual configuration files for specific applications or services. For example, you might have a configuration file for your web server's access logs or your database server's error logs. Each file in this directory tells logrotate how to handle the logs for that particular application. Third, the cron job is crucial. This is what triggers logrotate to run automatically. By default, logrotate is typically run daily. You can find the cron job configuration in /etc/cron.daily/logrotate. This script executes /usr/sbin/logrotate with the -s option to make sure the state file is updated. The state file, /var/lib/logrotate/status, keeps track of the last rotation time for each log file. Finally, the logrotate command itself, /usr/sbin/logrotate, is the actual program that does the work. You can run this manually with the -f (force) option to test your configurations or troubleshoot problems. Understanding these components is the first step towards mastering log rotation.

Common Reasons Why Logrotate Fails

Okay, let's get to the juicy part – why your logs aren't rotating! Several things can trip up logrotate, so let's go through the most common culprits. Understanding these issues is crucial for effective troubleshooting. Often, the issue is not immediately obvious, and you may need to delve deeper into the configuration files and system logs to find the root cause. One of the most frequent problems is incorrect configuration settings. Logrotate relies heavily on its configuration files, and even a small mistake can prevent it from working correctly. Let's delve into this further.

Configuration File Errors

First off, let's talk about those configuration files, specifically /etc/logrotate.conf and the files in /etc/logrotate.d/. These are where you tell logrotate how to behave. If there's an error in these files, logrotate might not run, or it might not work as expected. Syntax errors are a big one. Even a missing semicolon or a typo can cause problems. Make sure your configuration files are free of errors before proceeding with any other troubleshooting steps. Use a text editor that highlights syntax errors to identify potential issues easily. Another common error is an incorrect path to the log files. Logrotate needs to know where your logs are located to rotate them. Double-check that the paths in your configuration files are accurate. Relative paths, incorrect file names, or missing permissions can cause issues. Additionally, ensure that the log files actually exist in the specified locations. If the log file does not exist, logrotate will not be able to rotate it. Similarly, check for permissions issues. Logrotate needs the correct permissions to read and write log files. If the user running logrotate doesn't have the necessary permissions, it won't be able to rotate the logs. Ensure that the log files and the directories containing them are accessible by the user executing logrotate. Incorrectly defined settings, such as missingok or notifempty, may also cause problems. The use of incorrect values for rotation frequency, compression methods, or the number of rotations can also cause unexpected behavior. Make sure these settings align with your requirements. Use the -d (debug) option to test your configurations and look for any errors or warnings.

Cron Job Issues

Alright, let's move on to the cron job. As mentioned earlier, the cron job is what triggers logrotate to run automatically. If the cron job isn't running, logrotate won't run either! So, how do we check this? First, verify that the cron daemon is running on your system. You can usually do this by checking the system's status using commands like systemctl status cron or service cron status. If the cron daemon is not running, you need to start it. Next, examine the cron job configuration for logrotate. The cron job is usually located in /etc/cron.daily/logrotate. Verify that this script exists and that it has execute permissions. Check the contents of the script to ensure it is running the correct logrotate command. Another potential problem is that the cron job may be failing silently. To find out if this is the case, check the system logs. Look for error messages related to cron or logrotate in the system logs, such as /var/log/syslog or /var/log/messages. Check that the cron daemon is configured to send email notifications. If you're not receiving emails, this could indicate a problem with your mail configuration. Also, confirm the cron job is set up correctly. By default, the logrotate command should be executed daily via the /etc/cron.daily/logrotate script. If the script is modified or missing, the log rotation won't occur automatically. Verify the execution time set for the cron job. If the execution time does not suit your log rotation needs, you may not get the expected results.

Permissions Problems

Permissions are often a silent killer when it comes to log rotation. If the user running logrotate doesn't have the correct permissions, it will not be able to read, write, or modify the log files. Therefore, it's essential to check the permissions of the log files, the directories containing them, and the logrotate configuration files. Ensure that the user running the logrotate command (usually root or a designated system user) has read and write access to the log files. The logrotate process also needs to be able to create new log files and move or rename the existing ones. Review the ownership and permissions of the /var/log/ directory and any subdirectories. Make sure that the user running logrotate has the necessary permissions to access and modify these directories. Incorrect file permissions on the logrotate configuration files can also cause issues. The configuration files should be readable by the logrotate user. Similarly, the logrotate program must have execute permissions. Also, keep in mind that the owner and group of the log files could affect the process. Logrotate needs the appropriate privileges to move, rename, and compress the logs. If these permissions are incorrect, it will fail to rotate the logs. Furthermore, any custom scripts executed by logrotate (e.g., postrotate scripts) should have the necessary permissions. These scripts often need to modify the log files or perform other operations that require specific privileges. Ensure that the correct permissions are set to prevent rotation failures.

Other Potential Issues

Okay, let's cover some other potential issues that can mess with your log rotation. There are some less common, but still important, factors that can influence how logrotate operates. These are some of the things that can also cause problems.

SELinux or AppArmor: If you're using SELinux or AppArmor, security policies might be interfering with logrotate's ability to access and modify the log files. Check your security policies and make sure they allow logrotate to do its job. Sometimes, you might need to adjust the policies to accommodate log rotation. This can involve allowing logrotate to write to certain directories or execute specific commands. You can troubleshoot this by checking the system logs for SELinux or AppArmor denials. These denials can provide valuable insights into the specific actions being blocked. Then, you can modify the security policies accordingly.
Disk Space: Believe it or not, a full disk can also cause issues. If the disk where the logs are stored is full, logrotate might fail to compress or rotate the logs. Ensure that you have sufficient free disk space to accommodate the rotation process. The logrotate process needs enough space to create new log files, compress old ones, and archive them. Check the disk space usage with commands like df -h. If the disk is full, you'll need to free up some space before logrotate can function correctly. Consider increasing the disk space allocated to your log directories to avoid this issue. You can delete old log files manually, or if you can, extend the size of the partition.
File Attributes: Unusual file attributes can also cause problems. For example, if a log file has the immutable attribute set (using chattr +i), logrotate won't be able to modify it. Check for any unusual file attributes that might be preventing logrotate from working correctly. You can check these attributes with the lsattr command. If you find any, you can remove them using the chattr -i command, but be careful when modifying file attributes, as it can affect system security.
Incorrectly placed configuration files: Incorrect placement of custom configuration files can also lead to issues. Custom configuration files should be placed inside /etc/logrotate.d/. If these files are placed in other directories, logrotate may not be able to recognize or process them. When adding custom configurations, always ensure they're in the right place to be effective. Ensure that all the configuration files have the proper file permissions.

Troubleshooting Steps: A Practical Guide

Alright, let's get down to the nitty-gritty of troubleshooting. Here's a step-by-step approach to diagnosing and fixing those log rotation problems.

Check the basics: First things first, verify that the cron daemon is running. Use systemctl status cron or a similar command to check its status. Then, check the system logs (e.g., /var/log/syslog, /var/log/messages) for any errors related to logrotate or cron. Look for any unusual behavior or error messages. Make sure you can see regular logrotate entries in the logs. If you do not see any, it might suggest the cron job is not running. Check the /etc/cron.daily/logrotate script. Ensure it's present, has execute permissions, and contains the correct logrotate command. Verify the execution time of the cron job and whether it suits your log rotation needs. Check the contents of the file and ensure that it is running the command correctly. Also, make sure that the cron daemon is configured to send email notifications. If you're not receiving emails, this could indicate a problem with your mail configuration, so it is necessary to check your mail configuration. Also, double-check that your server's time is synchronized correctly to avoid unexpected issues.
Test manually: Try running logrotate manually with the -f (force) and -d (debug) options. For example, use the command /usr/sbin/logrotate -f -d /etc/logrotate.conf or /usr/sbin/logrotate -f -d /etc/logrotate.d/your_config_file. This will show you exactly what logrotate is trying to do and any errors it's encountering. The -f option forces the rotation, and the -d option enables debug mode, providing detailed information about the process. Run the command with the path to the specific configuration file for your application to test it individually. Then, check the output for any error messages or warnings that might indicate the cause of the issue. Pay close attention to any error messages related to file access, permissions, or configuration syntax. If the manual run works, then the problem is likely with the cron job or the system environment.
Examine configuration files: Carefully review your /etc/logrotate.conf and the files in /etc/logrotate.d/. Look for any syntax errors, incorrect file paths, or permission issues. Pay special attention to the rotate, size, dateext, compress, and missingok options. Make sure the file paths are accurate and the settings align with your requirements. Check for any conflicting options or incorrect values. Also, verify that the configuration files use the correct syntax and are free of errors. Comment out sections or make temporary changes to test configurations and narrow down the source of the problem. Use a text editor that highlights syntax errors to identify potential issues easily.
Check file permissions: Verify that the user running logrotate (usually root) has the correct permissions to access and modify the log files. Check the permissions of the log files, the directories containing them, and the logrotate configuration files. Incorrect permissions can prevent logrotate from reading or writing the files. Use ls -l to check the permissions of the log files and directories. Adjust the file permissions as needed using chmod to ensure that logrotate has the required access. Make sure the log files and the directories containing them are accessible by the user executing logrotate. If the permissions are incorrect, use the chmod command to fix them, ensuring read and write access for the logrotate user.
Look for SELinux/AppArmor conflicts: If you're using SELinux or AppArmor, check the system logs for any denials related to logrotate. You might need to adjust your security policies to allow logrotate to do its job. Inspect the audit logs or system logs for SELinux or AppArmor denial messages. These messages often indicate which actions are being blocked and why. Use tools like ausearch to search for specific denials. Adjust your SELinux or AppArmor policies to allow logrotate to perform the necessary operations if required. If you're not familiar with these tools, consult the documentation for your Linux distribution to configure these properly.
Verify Disk Space: Make sure there is enough disk space. If the disk is full, logrotate won't be able to rotate the logs. Use the df -h command to check disk space usage. Consider increasing the disk space allocated to your log directories. You can delete old log files manually or, if possible, extend the size of the partition. Regularly monitor disk space to prevent future issues. Also, consider setting up a monitoring system to alert you when disk space is running low.
Isolate the issue: If you have multiple log files, try isolating the issue. Create a minimal configuration file with just one log file to test. Test log rotation with simplified configurations to determine if the issue is global or specific to a particular file or configuration. This process can help you pinpoint whether the problem is with a specific log file, configuration setting, or a system-wide issue. If the log rotation works with a minimal configuration, then gradually add back more configurations to identify which part is causing the problem.

Advanced Troubleshooting: Digging Deeper

Sometimes, the issue isn't obvious. You may need to delve a bit deeper. Let's look at some advanced troubleshooting techniques.

Enable Verbose Logging: You can increase the verbosity of logrotate to get more detailed information. Modify the /etc/cron.daily/logrotate script or run logrotate manually with the -v (verbose) option. This will provide more insights into the rotation process. To enable verbose logging, edit the /etc/cron.daily/logrotate script. Find the line that runs logrotate and add the -v option to it. For example, change /usr/sbin/logrotate to /usr/sbin/logrotate -v. When you run logrotate manually, use the command /usr/sbin/logrotate -f -v /etc/logrotate.conf. Examine the verbose output to identify the exact actions being performed and any potential errors or warnings. This level of detail can help you understand precisely what's happening during the log rotation process.
Check the State File: Logrotate uses a state file (/var/lib/logrotate/status) to keep track of the last rotation time for each log file. If this file is corrupted or missing, logrotate might not work correctly. Check the contents of the state file. Make sure it contains information about your log files. If the state file is missing or corrupted, you might need to create it manually or reset its contents. The state file contains the last rotation time for each log file, which is crucial for determining whether a log file needs to be rotated. You can view the contents of the state file using the cat /var/lib/logrotate/status command. If the state file is missing, you can typically recreate it by running logrotate -f /etc/logrotate.conf. However, this will rotate all log files, regardless of their last rotation time. Ensure that the state file is correctly updated after each log rotation. Incorrect entries in the state file can lead to unexpected behavior.
Review the Logrotate Man Page: The man logrotate command is your best friend. It provides detailed information about all the options and settings available. The man page is an invaluable resource that you should consult regularly. The man logrotate command provides a comprehensive overview of logrotate's options, configuration syntax, and behavior. This can help you understand each setting and how it affects the log rotation process. Refer to the man page to better understand the various configuration options available. You'll find detailed explanations of each option and its functionality. The man page also includes examples and troubleshooting tips that can help you resolve issues. Look at the man page for specific settings related to your log file and ensure they are correct.
Use a Configuration Validator: Some tools can validate your logrotate configuration files and identify potential errors. Look for online or local tools that can parse the syntax of your configuration files and check them for common mistakes. These tools can help you identify configuration issues more efficiently. Use a logrotate configuration validator to verify your configurations for syntax errors and potential issues. These tools often highlight errors that might be missed during manual inspection. Many online tools can validate your configurations. Paste the contents of your logrotate configuration files into the tool and have it check for syntax errors or misconfigurations. The use of configuration validators reduces the time spent on troubleshooting.
Check for Custom Scripts: Logrotate can execute custom scripts before and after log rotation. Check if any custom scripts are interfering with the process. Custom scripts can often be a source of problems if they are not correctly configured. Examine the configuration file for custom scripts. These are typically specified using the prerotate, postrotate, and rotate directives. Review the contents of the scripts to ensure they are functioning correctly and that they have the necessary permissions. If the scripts are not working correctly, they can prevent log rotation from completing. Debug the scripts by adding logging statements or running them manually to identify any errors. Ensure that any custom scripts executed by logrotate (e.g., postrotate scripts) have the necessary permissions.

Prevention is Key: Best Practices for Logrotate

Alright, you've fixed the problem, but how do you prevent it from happening again? Here are some best practices.

Regularly review your configuration files: Make it a habit to periodically review your /etc/logrotate.conf and /etc/logrotate.d/ files. Check for any outdated configurations or potential issues. Also, make sure that the configuration file reflects the current log rotation needs. Regularly review your logrotate configurations to avoid errors and ensure that the process works efficiently. This should be part of your routine system maintenance. Doing so helps you identify potential problems before they become critical. Regularly check for syntax errors or misconfigurations, which are common sources of issues. Regularly update and maintain configuration files to keep them up to date.
Monitor disk space: Implement monitoring to keep an eye on disk space usage. Set up alerts to notify you when disk space is running low. Regularly monitor the disk space on the system to avoid sudden disk full issues. Use tools like df -h to monitor disk space. Set up automated alerts to notify you when disk space usage exceeds a predefined threshold. Monitor disk space usage regularly to catch any potential problems before they escalate. You can also automate the task by using monitoring tools.
Test your configurations: Before making any changes to your configuration files, test them. This ensures that the new changes are working as expected. Always test your configuration changes before deploying them to a production environment. Use the -d option to test the configurations. Test all new configurations in a testing environment before applying them to production systems. Testing helps you catch any potential issues early and ensures that your configurations are working as expected. This also helps prevent service disruptions caused by errors in the configuration files.
Keep your system updated: Make sure your system is up to date with the latest security patches and software updates. Software updates often include fixes for logrotate or its dependencies. Keeping your system up-to-date helps prevent known issues. Update your system to the latest versions to ensure logrotate and its dependencies function correctly. Regularly update the system packages to address any known bugs. Check for any security updates and install them promptly.
Document your configurations: Document your logrotate configurations, including the reason for any specific settings. Having clear documentation can help you troubleshoot issues more efficiently. Document all the changes made to the configuration files to keep track of any customizations. Maintain up-to-date documentation for all configuration changes, including comments explaining each setting. Make sure that the documentation is easy to understand. Well-documented configurations enable you to identify and resolve problems more easily.
Use a centralized logging system: Consider using a centralized logging system to manage your logs. Centralized logging can help you manage and analyze logs across multiple systems. Centralized logging systems can streamline log management and analysis. A centralized logging system helps you to manage, analyze and store the logs from multiple systems in one place. Using a centralized logging system allows you to manage logs from multiple systems efficiently. This can simplify your log management process, especially in a large infrastructure. Using a centralized logging system can improve security posture.

Wrapping Up

So there you have it, guys! We've covered the common causes and how to fix the issue where logrotate won't rotate your logs automatically. Remember to check your configurations, cron job, permissions, and consider the potential impact of SELinux/AppArmor or disk space. By following these steps and best practices, you can keep those logs rotating smoothly and ensure the health of your system. If you're still having trouble, don't hesitate to consult the logrotate man page or search for more specific solutions online. Happy logging, and thanks for reading Plastik Magazine! If you found this helpful, share it with your network, and feel free to leave a comment with any questions or additional tips. Stay tuned for more tech tips from your favorite magazine!