Logrotate

Last edited September 9, 2026

Logrotate

Pithy

Logrotate is a program that has builtin functions to Target and handle logs.
The core goal prevent a single log file from growing infinitely, instead compress and later delete (configurable)

• logroute is normally run using cron once a day.

• /etc/logrotate.conf standard cfg is here,

• /etc/logrotate.d the canonical place for logrotate config files.

• logrotate-aware software packages (there are many) can drop in log management instructions as part of their installation procedure, thus greatly simplifying administration.

Tip

You could write custom logic to handle your logs using a systemd timer or a cron job… but why would you? logrotate implements all the typical things you’d want to do with a log and it’s easier for others to understand how they’re being managed.

Logrotate commands

Real Example

1. I want to stop my kubeview log from getting so big, 1KB is too big!

   # /etc/logrotate.d/kubeview
   
   /var/log/kubeview.log {
       size 1K   # rotate once log hits 1KB - note: must be UPPERCASE
       rotate 3  # keep logs from last 3 rotates
       compress  # compress all noncurrent version of the log file
   }
   
   # Note for some reason the comments broke the logrotate parser, so if you're having
   # issues try remove the comments

   Note

   We’re not specifying a date like daily,weekly,monthly instead we’re doing a size. logrotate is run on a cronjob /etc/cron.daily/logrotate so it will check the size on that schedule, no need for a time and a size be specified.

2. Let’s test if my logrotate config is working

   # -d = "debug", it won't actually run rather it will print what would have done
   sudo logrotate -d /etc/logrotate.d/kubeview
   
   # unimportant details are omitted
   reading config file /etc/logrotate.d/kubeview
   Handling 1 logs                                                   # 1 log file match my config
   rotating pattern: /var/log/kubeview.log  1024 bytes (3 rotations) # Rotate at 1024 bytes (1KB), keep 3 old compressed versions
   considering log /var/log/kubeview.log                             # about to check if rotation is needed
   Last rotated at 2026-06-06 00:00                                  # logrotate last ran at midnight
   log needs rotating                                                # the logic triggered to rotate the log (size > 1KB)
   
   renaming /var/log/kubeview.log.1.gz to /var/log/kubeview.log.2.gz # casecade, everything shifts down one
   renaming /var/log/kubeview.log.2.gz to /var/log/kubeview.log.3.gz # rotate only keeps 3 so 4 gets deleted
   renaming /var/log/kubeview.log.3.gz to /var/log/kubeview.log.4.gz
   log /var/log/kubeview.log.4.gz doesn't exist -- won't try to dispose of it 
   
   renaming /var/log/kubeview.log to /var/log/kubeview.log.1         # current log becomes .1
   compressing log with: /bin/gzip                                   # kubeview.log.1 get gzipped to kubeview.log.1.gz

3. Looks good to me, now let’s manually run it to see what it will actually do when cron takes over

   # -f forces the logrotate config to trigger
   $ sudo logrotate -f /etc/logrotate.d/kubeview
   
   $ ls -lh /var/log/kubeview.log*              
   -rw-r--r-- 1 root root  591 Jun  6 11:08 /var/log/kubeview.log.1.gz
   -rw-r--r-- 1 root root 1.1K Jun  5 11:13 /var/log/kubeview.log.2.gz
   $ sudo systemctl restart kubeview # triggering some logs
   $ ls -lh /var/log/kubeview.log*   # the new log file is created and the 2 compressed logs exist
   -rw-r--r-- 1 root root  755 Jun  6 11:10 /var/log/kubeview.log
   -rw-r--r-- 1 root root  591 Jun  6 11:08 /var/log/kubeview.log.1.gz
   -rw-r--r-- 1 root root 1.1K Jun  5 11:13 /var/log/kubeview.log.2.gz