Master Logrotate: Complete Guide to Linux Log Rotation and Custom Scripts

Logrotate is a Linux log file management tool that rotates, compresses, and removes old logs to save disk space.

Configuration Files Overview

The main configuration file is /etc/logrotate.conf; additional per‑service files are placed in /etc/logrotate.d/ and are automatically included.

Basic Usage

Logrotate runs daily via the cron script /etc/cron.daily/logrotate. The default script executes /usr/sbin/logrotate /etc/logrotate.conf and logs any errors.

Key Directives

rotate – number of rotated logs to keep.

daily , weekly , monthly – rotation frequency.

compress / nocompress – whether to gzip the rotated files.

dateext – append the current date to rotated filenames.

missingok – ignore missing log files.

notifempty – skip rotation if the log is empty.

sharedscripts – run postrotate scripts once after all logs are processed.

postrotate / prerotate – custom commands executed before/after rotation.

Example: Nginx Log Rotation

/etc/logrotate.d/nginx {
    daily
    rotate 7
    missingok
    notifempty
    dateext
    sharedscripts
    postrotate
        if [ -f /usr/local/nginx/logs/nginx.pid ]; then
            kill -USR1 `cat /usr/local/nginx/logs/nginx.pid`
        fi
    endscript
}

Example: PHP Log Rotation

/Data/logs/php/*log {
    daily
    rotate 365
    missingok
    notifempty
    compress
    dateext
    sharedscripts
    postrotate
        if [ -f /Data/app/php5.6.26/var/run/php-fpm.pid ]; then
            kill -USR1 `cat /Data/app/php5.6.26/var/run/php-fpm.pid`
        fi
    endscript
    postrotate
        /bin/chmod 644 /Data/logs/php/*gz
    endscript
}

Manual Rotation and Debugging

Force rotation with logrotate -f /etc/logrotate.conf. Use -d for debug mode to see what would happen without making changes.

Adjusting Cron Timing

Logrotate runs according to the system's /etc/anacrontab (default around 3 am). To change the schedule, modify the cron entry or add a custom crontab line, e.g., 59 23 * * * /usr/sbin/logrotate -f /etc/logrotate.d/nginx to run nightly at 23:59.

Custom Shell Script for Log Rotation

#!/bin/bash
log_path=$1
yesterday=$(date -d "yesterday" +"%Y%m%d")
cp ${log_path} ${log_path}.${yesterday}
rm -f ${log_path}.$(date -d "7 days ago" +"%Y%m%d")

Use

find /path/to/logs -size +0 -name "*.log" | xargs /path/to/log_rotate.sh

to rotate logs that are not empty.

Python Script Example

#!/usr/bin/env python
import datetime, os, shutil
log_path = '/opt/jumpserver/logs/'
log_file = 'jumpserver.log'
yesterday = datetime.datetime.now() - datetime.timedelta(days=1)
archive_dir = os.path.join(log_path, yesterday.strftime('%Y'), yesterday.strftime('%m'))
os.makedirs(archive_dir, exist_ok=True)
shutil.move(os.path.join(log_path, log_file),
            os.path.join(archive_dir, f"{log_file}_{yesterday.strftime('%Y%m%d')}.log"))

Schedule the script with cron to run daily.

Troubleshooting Logrotate Failures

If a specific log (e.g., Nginx) is not rotating, check the service’s logrotate.d configuration, verify file size thresholds, and ensure the cron job is executing. Use the -d flag to debug and consider adding -f to force rotation.