Logrotate Cheatsheet — 60+ Directives, Commands and Gotchas with Copy-Ready Templates

Run logrotate with the main config file. Normally invoked daily by cron (/etc/cron.daily/logrotate) or a systemd timer.

⚠ Common pitfall: Running manually as a non-root user can silently skip files that require elevated privileges. Always check the status file afterward.

logrotate /etc/logrotate.conf

sudo logrotate /etc/logrotate.conf

Dry-run / debug mode. Shows what logrotate would do — which files match, which would rotate, whether the postrotate script is valid — without actually rotating anything.

⚠ Common pitfall: `-d` implies `-v`. The output says "rotating" but NOTHING is actually rotated. Confirm this every time you test a new config.

logrotate -d /etc/logrotate.conf

logrotate -d /etc/logrotate.d/nginx

sudo logrotate --debug /etc/logrotate.d/myapp

Force rotation even if it is not due yet (the log was rotated recently). Essential for testing a new config on a log that was just rotated.

⚠ Common pitfall: Always dry-run with `-d` first. `-f` on a misconfigured glob can move or truncate files you did not intend to touch.

sudo logrotate -f /etc/logrotate.conf

sudo logrotate -f /etc/logrotate.d/nginx

sudo logrotate --force /etc/logrotate.d/myapp

Verbose mode. Prints each file being considered, whether it is being rotated, and the result of each directive — useful for diagnosing why a log is not rotating.

sudo logrotate -v /etc/logrotate.conf

sudo logrotate -v /etc/logrotate.d/nginx

sudo logrotate -v -f /etc/logrotate.d/myapp

Force + verbose on a single config file. The most useful combination when testing one service's rotation config in isolation.

sudo logrotate -f -v /etc/logrotate.d/nginx

sudo logrotate -f -v /etc/logrotate.d/myapp

Use a custom status file to track rotation timestamps. Default is /var/lib/logrotate/status (or /var/lib/logrotate.status on some distros).

⚠ Common pitfall: If the status file is not writable by the user running logrotate, rotations that "succeed" are never recorded and will repeat on every run.

logrotate -s /var/lib/logrotate/status /etc/logrotate.conf

logrotate -s /tmp/lr-test.status -f -v /etc/logrotate.d/nginx

View the logrotate status file to see when each log file was last rotated. Helps diagnose why a file is or is not being rotated.

cat /var/lib/logrotate/status

grep nginx /var/lib/logrotate/status

grep myapp /var/lib/logrotate/status

Print the installed logrotate version. Some directives (hourly, maxage, dateyesterday) require logrotate ≥ 3.9.

logrotate --version

Keep N old log files before deleting the oldest. `rotate 7` keeps 7 backups (log.1 … log.7). Setting `rotate 0` deletes the log immediately after rotation.

⚠ Common pitfall: Default is `rotate 4` — if you omit this directive your old logs start disappearing after the fourth rotation.

rotate 7

rotate 30

rotate 0  # delete immediately

Rotate logs once per day. Logrotate checks the last rotation timestamp in the status file and rotates if 24 h have elapsed.

daily

Rotate once per week — when the day of the week is less than the day of the last rotation, or at least 7 days have elapsed.

weekly

Rotate once per month — on the first time logrotate runs in a month, after having been run in the previous month.

monthly

Rotate once per year — on the first time logrotate runs in a calendar year after the previous year.

yearly

Rotate once per hour. Requires logrotate ≥ 3.9.0 AND logrotate must be invoked from cron.hourly (not cron.daily).

⚠ Common pitfall: Adding `hourly` to a config that is only triggered by cron.daily achieves nothing — logrotate runs once a day regardless of the directive.

hourly

# also add to /etc/cron.hourly/logrotate:
#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf

Rotate when the log file reaches this size regardless of time. Units: k (KB), M (MB), G (GB). Size check happens at every logrotate invocation.

⚠ Common pitfall: `size` OVERRIDES time-based directives (daily/weekly). If both are in the same block, size wins — daily/weekly have no effect.

size 100M

size 500k

size 1G

Rotate when the file exceeds this size even if the time condition is not yet met. Unlike `size`, it works alongside daily/weekly — rotation happens on size OR on schedule, whichever comes first.

maxsize 100M

maxsize 500M

Only rotate if the file is at least this size, even if the time condition is met. Prevents creating empty or near-empty rotated archives.

minsize 1M

minsize 10M

Delete rotated log files older than N days. Works independently of the `rotate` count — the older of maxage or rotate count wins.

⚠ Common pitfall: Requires logrotate ≥ 3.9.0. On older systems this directive is silently ignored.

maxage 30

maxage 90

Compress rotated log files with gzip (default compressor). The rotated file gets a .gz extension.

⚠ Common pitfall: For live daemons, always pair with `delaycompress` — compressing immediately can race with the daemon finishing writes to the old fd.

compress
delaycompress

Keep rotated files uncompressed (plain text). Use when disk space is plentiful or you need fast access to recent rotated logs without decompressing.

nocompress

Defer compression by one rotation cycle. The just-rotated file (log.1) stays uncompressed; the previous one (log.2) gets compressed on this run.

⚠ Common pitfall: `delaycompress` has no effect without `compress`. Always write both directives together in the same block.

compress
delaycompress

Use an alternative compression command instead of gzip. Common choices: bzip2 (smaller, slower), xz (best ratio, slowest), zstd (fast + good ratio).

compresscmd /usr/bin/bzip2
compressext .bz2

compresscmd /usr/bin/xz
compressext .xz
compressoptions -9

compresscmd /usr/bin/zstd
compressext .zst
compressoptions -19

Pass extra flags to the compression command. For gzip: `-9` for maximum compression; `-1` for fastest speed.

compressoptions -9

compressoptions --fast

File extension appended to compressed rotated files. Defaults to `.gz`. Must match the chosen `compresscmd`.

compressext .bz2

compressext .xz

compressext .zst

Copy the log file to a new name, then truncate the original to zero length in place. The daemon keeps writing to the same inode — useful for processes that cannot be signalled to reopen their log.

⚠ Common pitfall: Data written between the copy and the truncate is silently lost — a race window that can lose several milliseconds of log entries. Prefer `postrotate` + signal for any daemon that supports it.

copytruncate

Copy the log file to a new name but do NOT truncate the original. Useful for external log shippers that need a snapshot without affecting the live daemon.

⚠ Common pitfall: `copy` does not reduce the log file size — the original keeps growing. Pair with a separate truncation step or use it only for archival.

copy

Script block executed after the log file is rotated. Use it to signal the daemon to reopen its log files. The script runs with /bin/sh.

⚠ Common pitfall: A non-zero exit code marks the rotation as failed. Always test your postrotate script with `bash -x` before wiring it in.

/var/log/nginx/*.log {
    daily
    rotate 14
    compress
    delaycompress
    sharedscripts
    postrotate
        kill -USR1 $(cat /var/run/nginx.pid)
    endscript
}

Script block executed BEFORE the log is rotated. Runs even if the log would not actually be rotated (missingok etc.).

⚠ Common pitfall: Unlike postrotate, prerotate also runs when rotation is skipped due to `notifempty` or `size` not being met — guard against false signals.

/var/log/myapp/*.log {
    weekly
    prerotate
        /usr/local/bin/myapp-flush-buffers
    endscript
    postrotate
        systemctl kill -s USR1 myapp
    endscript
}

Script block executed once before ALL log files in the block are rotated, regardless of how many files match the glob.

/var/log/myapp/*.log {
    daily
    firstaction
        echo "Starting rotation at $(date)" >> /var/log/rotation-events.log
    endscript
}

Script block executed once after ALL log files in the block are rotated.

/var/log/myapp/*.log {
    daily
    lastaction
        echo "Rotation done at $(date)" >> /var/log/rotation-events.log
    endscript
}

Run postrotate / prerotate scripts ONCE for all files matching the glob, not once per file. Essential when the glob matches multiple log files.

⚠ Common pitfall: Without `sharedscripts`, `/var/log/nginx/*.log` with two log files sends nginx two SIGUSR1 signals — harmless but redundant. Always add it when using globs.

/var/log/nginx/*.log {
    daily
    sharedscripts
    postrotate
        kill -USR1 $(cat /var/run/nginx.pid)
    endscript
}

Default. Run postrotate / prerotate scripts once per rotated file. Use only when each file needs a different postrotate action.

nosharedscripts

Skip rotation if the log file is empty (zero bytes). Prevents creating useless empty compressed archives.

notifempty

Rotate the log file even if it is empty. This is the default — override with `notifempty` for most production logs.

ifempty

Do not report an error if the log file does not exist. Good for services that may be installed but not yet started, or for optional logs.

⚠ Common pitfall: `missingok` should NOT be used on logs for critical services — a missing log is often a sign the service is down or misconfigured.

missingok

Error if the log file does not exist. This is the default — logrotate exits non-zero if a glob matches nothing.

nomissingok

Append the date (YYYYMMDD by default) to rotated filenames instead of a numeric suffix. access.log → access.log-20260628.

⚠ Common pitfall: If logrotate runs multiple times per day and generates the same date suffix, the second run fails with "log.YYYYMMDD already exists". Use `dateformat` with an hour component for sub-daily rotation.

dateext

dateext
dateformat -%Y%m%d-%H%M

Customize the date suffix appended by `dateext`. Accepts strftime format strings. Include `%H%M` for sub-daily rotation to avoid filename collisions.

dateext
dateformat -%Y-%m-%d

dateext
dateformat -%Y%m%d-%H%M  # hourly without collision

When using `dateext`, use yesterday's date instead of today's. Useful when rotating at midnight — the rotated file represents yesterday's traffic.

⚠ Common pitfall: Requires logrotate ≥ 3.9.0. Silently ignored on older versions.

dateext
dateyesterday

Create a new empty log file after rotation, with the specified permissions, owner, and group. Mode is octal. Omit mode/owner/group to use the original file's attributes.

⚠ Common pitfall: If the daemon cannot write to the newly-created file (wrong owner/mode), it will silently drop log entries until you fix permissions.

create 0640 www-data adm

create 0644 nginx nginx

create  # use original file attributes

Do NOT create a new log file after rotation. Use when the daemon creates its own log file on the next write, or when using `copytruncate`.

nocreate

Move rotated log files to a different directory. Useful for separating live logs from archives on different mount points.

⚠ Common pitfall: The olddir must be on the same filesystem as the log file, otherwise logrotate falls back to copy+delete which is slow for large logs.

olddir /var/log/archive

olddir /mnt/logarchive/nginx

Run the rotation as the specified user and group. Required when log files are owned by a non-root user and logrotate runs as root.

⚠ Common pitfall: Without `su`, logrotate running as root may create rotated files owned by root, breaking the daemon's write access after the next rotation.

su www-data www-data

su nginx nginx

Skip files with these extensions when logrotate processes a config that itself references a directory. Default list includes: .bak .rpmsave .rpmorig .orig .dpkg-old .dpkg-dist.

⚠ Common pitfall: Config files in /etc/logrotate.d/ MUST have no extension. A file named `nginx.conf` is silently skipped by the default tabooext list.

tabooext + .conf .log  # add .conf and .log to default list

tabooext .bak          # REPLACE default list with just .bak

Include another config file or all files in a directory. Standard way to load service-specific configs from /etc/logrotate.d/.

⚠ Common pitfall: `include <dir>` is NOT recursive — files in subdirectories are not loaded. Only the top level of the specified directory is read.

include /etc/logrotate.d

include /etc/logrotate.d/nginx

Send SIGUSR1 to nginx to reopen its log files. Nginx gracefully completes current requests then starts writing to the new log. Use in a postrotate block.

⚠ Common pitfall: If nginx is not running, `cat /var/run/nginx.pid` exits non-zero and the postrotate fails. Guard with: `[ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid)`.

kill -USR1 $(cat /var/run/nginx.pid)

[ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid) || true

nginx -s reopen

Alternative to SIGUSR1 for nginx. Sends the reopen signal via the nginx master process, which is slightly safer than looking up the PID manually.

nginx -s reopen

sudo nginx -s reopen

Send SIGHUP to Apache httpd to gracefully reopen log files. Apache completes in-flight requests before reopening.

⚠ Common pitfall: On some distros the PID file is at /var/run/httpd/httpd.pid or /run/apache2/apache2.pid. Check `ps aux | grep apache` if the kill fails.

kill -HUP $(cat /var/run/apache2/apache2.pid)

apachectl graceful

systemctl reload apache2

Send SIGUSR1 to rsyslog via systemd to reopen all log files. Preferred over direct kill on systemd systems because it handles socket activation.

systemctl kill -s USR1 rsyslog.service

systemctl reload rsyslog

kill -USR1 $(cat /var/run/syslogd.pid)

Flush and reopen MySQL general query log and slow query log. SIGUSR1 is equivalent to `FLUSH LOGS` for the file-based logs.

⚠ Common pitfall: MySQL binary logs (binlogs) are NOT affected by SIGUSR1 — use `FLUSH BINARY LOGS` inside MySQL for those.

kill -USR1 $(cat /var/run/mysqld/mysqld.pid)

mysqladmin -u root -p flush-logs

Reload PostgreSQL config without dropping connections. PostgreSQL reopens log files on SIGHUP — this is the cleanest way to trigger it via postrotate.

systemctl reload postgresql

pg_ctlcluster 14 main reload

kill -HUP $(head -1 /var/lib/postgresql/14/main/postmaster.pid)

Data written to the log between the copy step and the truncate step is silently dropped. On a high-traffic server writing 10K lines/sec this can lose several seconds of log entries per rotation.

⚠ Common pitfall: Mitigation: use `postrotate` + SIGUSR1 for any daemon that supports it. Use `copytruncate` only as a last resort for legacy daemons.

# AVOID for live daemons:
copytruncate

# PREFER (zero data loss):
sharedscripts
postrotate
    kill -USR1 $(cat /var/run/nginx.pid)
endscript

Compressing the just-rotated file immediately races with the daemon finishing its last write to the old file descriptor. The result can be a corrupt or incomplete .gz archive.

⚠ Common pitfall: Always write `compress` and `delaycompress` together in the same block for live daemon logs.

# CORRECT:
compress
delaycompress

# RISKY for live daemons:
compress
# (no delaycompress)

Any non-zero exit from postrotate, prerotate, firstaction, or lastaction marks the rotation failed in the status file. The log file has already been renamed — the daemon is now writing to a ghost path.

⚠ Common pitfall: Debug with: `bash -x /tmp/test-postrotate.sh` and confirm exit 0 before wiring into logrotate.

# Guard against missing PID file:
postrotate
    [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid) || true
endscript

If logrotate runs more than once per day (e.g. hourly) with `dateext` using only date (no time), the second run finds a file like `access.log-20260628` already exists and fails.

⚠ Common pitfall: Fix: `dateformat -%Y%m%d-%H%M` adds hour and minute, making each rotation's filename unique within the day.

# BROKEN for hourly rotation:
dateext
# dateformat -%Y%m%d (default)

# FIXED:
dateext
dateformat -%Y%m%d-%H%M

Config files in /etc/logrotate.d/ must have NO extension. Files like `nginx.conf`, `myapp.log`, or `service.bak` are silently ignored by the default tabooext list.

⚠ Common pitfall: Correct names: `nginx`, `myapp`, `rsyslog` — plain words, no dot-extension.

# WRONG — silently skipped:
/etc/logrotate.d/nginx.conf

# CORRECT:
/etc/logrotate.d/nginx

When logrotate runs as root but logs are owned by an app user, rotated files may end up owned by root. The daemon then cannot write to the new log file after a postrotate signal.

⚠ Common pitfall: Fix: add `su <user> <group>` and `create <mode> <user> <group>` to set the correct ownership on both the backup and the new log.

/var/log/myapp/*.log {
    daily
    su myapp myapp
    create 0640 myapp myapp
    rotate 30
}

If the logrotate status file (/var/lib/logrotate/status) is not writable by the user running logrotate, every run sees the log as "not yet rotated" and rotates it again — infinite daily re-rotation.

⚠ Common pitfall: Check with: `ls -la /var/lib/logrotate/` and ensure the file is writable by the logrotate process user.

ls -la /var/lib/logrotate/status

sudo chown root:root /var/lib/logrotate/status
sudo chmod 644 /var/lib/logrotate/status

Production-ready logrotate config for nginx. Rotates daily, keeps 30 days, compresses with a delay, signals nginx once for all log files.

/var/log/nginx/*.log {
    daily
    rotate 30
    compress
    delaycompress
    notifempty
    missingok
    sharedscripts
    dateext
    dateformat -%Y%m%d
    create 0640 www-data adm
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid) || true
    endscript
}

General-purpose config for an application that supports SIGUSR1 to reopen its log. Rotate daily, keep 14 days, gzip with delay, create new file with correct ownership.

/var/log/myapp/*.log {
    daily
    rotate 14
    compress
    delaycompress
    notifempty
    missingok
    sharedscripts
    dateext
    su myapp myapp
    create 0640 myapp myapp
    postrotate
        systemctl kill -s USR1 myapp.service || true
    endscript
}

Standard config for /var/log/syslog, messages, kern.log etc. Weekly rotation, 4 weeks retention, compressed, signals rsyslog once.

/var/log/syslog
/var/log/messages
/var/log/kern.log
/var/log/auth.log
{
    weekly
    rotate 4
    compress
    delaycompress
    notifempty
    missingok
    sharedscripts
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

Config for Docker containers using the `json-file` log driver with output redirected to a named path. Uses copytruncate because Docker's log daemon cannot reopen files via signal.

/var/lib/docker/containers/*/*-json.log {
    daily
    rotate 7
    compress
    delaycompress
    notifempty
    missingok
    copytruncate
    maxsize 100M
}

Rotate MySQL slow query log daily. Uses mysqladmin flush-logs to safely reopen the file — avoids SIGUSR1 complications with binary logs.

⚠ Common pitfall: FLUSH LOGS also rotates binary logs — if you only want to reopen text logs, use `FLUSH SLOW LOGS` or `FLUSH ERROR LOGS` (MySQL 5.7+).

/var/log/mysql/mysql-slow.log {
    daily
    rotate 14
    compress
    delaycompress
    notifempty
    missingok
    su mysql mysql
    create 0640 mysql adm
    postrotate
        mysqladmin -u root -p"${MYSQL_ROOT_PASS}" flush-slow-logs 2>/dev/null || true
    endscript
}