logrotate directives¶

Synopsis¶

logrotate [-d] [-f] [-v] [-s STATEFILE] [-l LOGFILE] [-m COMMAND] CONFIG_FILE…

# global directives
DIRECTIVE [VALUE]
include /etc/logrotate.d

# a log file definition
PATH [PATH…] {
    DIRECTIVE [VALUE]
    …
    postrotate
        SHELL COMMANDS
    endscript
}

Description¶

logrotate renames, compresses and deletes log files according to rules in its configuration files. It is normally run once a day; each run decides, per file, whether rotation is due, based on the rule and on the time of the last rotation recorded in its state file.

A configuration file contains global directives, which apply to the log file definitions that follow them, and log file definitions: one or more paths or glob patterns followed by directives in braces. Directives in a definition override the global ones. include reads another file, or every file in a directory, at that point; /etc/logrotate.conf includes /etc/logrotate.d/, where packages and administrators put one file per application. Values may be separated from directives by spaces or =. Lines whose first non-blank character is # are comments.

Configuration files must not be writable by group or others.

Checked against logrotate 3.22.0 on Debian 13 and Arch Linux (installed from the repositories), Ubuntu 26.04, AlmaLinux 10, Rocky Linux 10, and Gentoo (app-admin/logrotate-3.22.0) (November 2026).

Options¶

Option	Effect
`-d`, `--debug`	Print debug messages showing what would be done, without rotating anything or updating the state file
`-f`, `--force`	Rotate every matching file now, even if the rule says it isn't due
`-v`, `--verbose`	Print messages while rotating
`-s FILE`, `--state=FILE`	Use another state file; `/dev/null` means none
`-l FILE`, `--log=FILE`	Write verbose output to the file, or to syslog with `-l syslog`
`-m COMMAND`, `--mail=COMMAND`	Command used to send mail, for the `mail` directive
`--skip-state-lock`	Don't lock the state file
`--wait-for-state-lock`	Wait for another `logrotate` to release the state file lock, instead of exiting with status 3
`--usage`, `-?`, `--help`, `--version`	Show usage, help or the version

If a directory is given as CONFIG_FILE, every file in it is read. Running logrotate on a single file from /etc/logrotate.d/ doesn't read the global directives of /etc/logrotate.conf.

Directives¶

Frequency¶

Directive	Rotate when
`hourly`	An hour has passed since the last rotation (only useful if `logrotate` itself runs hourly)
`daily`	A day has passed
`weekly [WEEKDAY]`	The weekday (0 = Sunday … 6 = Saturday; default 0) is reached, or at least 7 days have passed; `7` means every 7 days regardless of weekday
`monthly`	The first run in a new month
`yearly`	The first run in a new year
`size SIZE`	The file is larger than SIZE, regardless of time; `k`, `M`, `G` suffixes. Exclusive with the time-based directives: the last one given wins
`minsize SIZE`	Rotate on the time schedule, but only if the file is larger than SIZE
`maxsize SIZE`	Rotate on the time schedule, or earlier if the file is larger than SIZE

Retention¶

Directive	Effect
`rotate COUNT`	Keep COUNT old copies; `0` deletes old copies immediately; `-1` never deletes them. Default `0`
`maxage DAYS`	Delete old copies older than DAYS (checked only when the log is rotated)
`minage DAYS`	Don't rotate files younger than DAYS
`olddir DIR`, `noolddir`	Move old copies into DIR (relative to the log's directory unless absolute), or keep them beside the log (default)
`createolddir [MODE [OWNER [GROUP]]]`, `nocreateolddir`	Create `olddir` if it doesn't exist
`mail ADDRESS`, `nomail`	Mail a copy that is about to be deleted to ADDRESS
`mailfirst`, `maillast`	Mail the just-rotated copy, or the about-to-expire one (default)
`shred`, `noshred`, `shredcycles COUNT`	Delete old copies with `shred -u`, overwriting them first

File selection¶

Directive	Effect
`missingok`, `nomissingok`	Ignore a missing log file, or report an error (default)
`ifempty`, `notifempty`	Rotate empty files (default), or skip them
`ignoreduplicates`	Ignore later definitions that match a file already matched
`tabooext [+] LIST`	File extensions that `include` skips in a directory; `+` adds to the list. The default list includes `.dpkg-old`, `.rpmnew`, `.rpmsave`, `.swp`, `~` and others
`taboopat [+] LIST`	Glob patterns that `include` skips
`allowhardlink`, `noallowhardlink`	Rotate files with more than one hard link, or skip them (default)

File handling¶

Directive	Effect
`create [MODE [OWNER [GROUP]]]`	After renaming the log, create a new empty file; omitted attributes are copied from the old file
`nocreate`	Don't create a new file
`copytruncate`	Copy the log, then truncate the original in place; for programs that can't reopen their log. Lines written between the copy and the truncation are lost. `create` has no effect
`copy`	Copy the log and leave the original unchanged
`renamecopy`	Rename the log to a temporary name, run `postrotate`, then copy it to its final name; allows `olddir` on another filesystem
`su USER GROUP`	Rotate as this user and group; needed when the log's directory is writable by a non-root user or group

Compression¶

Directive	Effect
`compress`, `nocompress`	Compress old copies, by default with `gzip`; or don't (default)
`delaycompress`, `nodelaycompress`	Leave the newest old copy uncompressed until the next rotation
`compresscmd COMMAND`	Compression command, such as `xz` or `zstd`
`uncompresscmd COMMAND`	Decompression command (for `mail`)
`compressext EXT`	Extension of compressed copies; by default that of the compression command
`compressoptions OPTIONS`	Options for the compression command; default `-6` for `gzip`

File names¶

Directive	Effect
`dateext`, `nodateext`	Name old copies with a date (`app.log-20261107`) instead of a number (`app.log.1`)
`dateformat FORMAT`	The date suffix, with `%Y %m %d %H %M %S %V %s %z`; default `-%Y%m%d` (`-%Y%m%d%H` with `hourly`). Must sort in time order
`dateyesterday`	Use yesterday's date, matching the content of a log rotated after midnight
`datehourago`	Use the time an hour ago, for `hourly`
`extension EXT`	Keep the extension at the end: `app.log` becomes `app.1.log` rather than `app.log.1`
`addextension EXT`	Add EXT after rotation
`start NUMBER`	First number for numbered copies; default 1

With dateext, a file can be rotated only once per date suffix; a second rotation on the same day fails with destination … already exists, skipping rotation.

Scripts¶

Each script runs with /bin/sh, from the line after the keyword to endscript, as the user running logrotate (not the su user).

Directive	Runs
`firstaction` … `endscript`	Once, before any file matching the definition is rotated, if at least one will be
`prerotate` … `endscript`	Before each file is rotated
`postrotate` … `endscript`	After each file is rotated, before it is compressed; typically to make the program reopen its log
`lastaction` … `endscript`	Once, after all matching files are rotated
`preremove` … `endscript`	Before an old copy is deleted, with its name as argument
`sharedscripts`, `nosharedscripts`	Run `prerotate` and `postrotate` once for the whole definition, or once per file (default)

Without sharedscripts, a script receives the log's path as $1 (and, for postrotate, the rotated copy's path as $2); with it, $1 is the definition's pattern.

Including files¶

Directive	Effect
`include FILE_OR_DIR`	Read a file, or every regular file in a directory in alphabetical order, skipping taboo extensions and patterns

How it runs¶

Debian/UbuntuRHEL/Alma/RockyArchGentoo

logrotate.timer runs logrotate.service daily (OnCalendar=daily, with up to an hour's random delay, and Persistent=true to catch up after downtime), which runs /usr/sbin/logrotate /etc/logrotate.conf. The package also installs /etc/cron.daily/logrotate, which exits without doing anything when systemd is running. logrotate is part of standard Debian and Ubuntu installations; only the Debian 13 cloud image omits it. The timer is enabled when the package is installed.

Ubuntu's /etc/logrotate.conf:

weekly
su root adm
rotate 4
create
include /etc/logrotate.d

Debian's is the same without su root adm.

logrotate.timer runs logrotate.service daily, as on Debian; there's no cron job. /etc/logrotate.conf:

weekly
rotate 4
create
dateext
include /etc/logrotate.d

The package installs logrotate.timer and links it into timers.target under /usr/lib/systemd/system/, so it runs daily from the next boot; systemctl enable --now logrotate.timer starts it at once. /etc/logrotate.conf:

weekly
rotate 4
create
tabooext + .pacorig .pacnew .pacsave
include /etc/logrotate.d
/var/log/wtmp {
    monthly
    create 0664 root utmp
    minsize 1M
    rotate 1
}
/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

With OpenRC, app-admin/logrotate installs /etc/cron.daily/logrotate, which a cron daemon must run; it isn't installed by default. With sys-process/cronie, the daily jobs run through anacron, so they also run after the machine was off at the scheduled time. The package also installs logrotate.timer and logrotate.service for the systemd profile (not checked in a lab). /etc/logrotate.conf (the wtmp and btmp definitions are as on Arch):

weekly
rotate 4
create
dateext
compress
notifempty
nomail
noolddir
include /etc/logrotate.d

Gentoo leaves the choice of syslog daemon to the administrator. sysklogd, which the lab uses, rotates its own files and has no logrotate rule; rsyslog and syslog-ng ship rules in /etc/logrotate.d/.

On the systemd families, logrotate.service runs with ProtectSystem=full, which makes /usr, /boot and /etc read-only for it, so it can't rotate logs kept there.

Examples¶

# An application log, rotated daily, 14 compressed copies kept,
# for a program that can't reopen its file.
/var/log/myapp/*.log {
    daily
    rotate 14
    missingok
    notifempty
    compress
    delaycompress
    dateext
    copytruncate
}

# Web server logs, rotated weekly or at 100 MB, then the server is told
# to reopen its files.
/var/log/nginx/*.log {
    weekly
    maxsize 100M
    rotate 8
    missingok
    notifempty
    compress
    delaycompress
    create 0640 www-data adm
    sharedscripts
    postrotate
        systemctl reload nginx.service >/dev/null 2>&1 || true
    endscript
}

sudo logrotate -d /etc/logrotate.d/myapp     # dry run of one file's rules
sudo logrotate -f /etc/logrotate.d/myapp     # force a rotation now
sudo logrotate -v /etc/logrotate.conf        # a normal run, with messages

Files¶

Path	Purpose
`/etc/logrotate.conf`	Main configuration
`/etc/logrotate.d/`	One file of rules per package or application
`/var/lib/logrotate/status`	State file: Debian and Ubuntu
`/var/lib/logrotate/logrotate.status`	State file: RHEL family
`/var/lib/logrotate.status`	State file: Arch
`/var/lib/misc/logrotate.status`	State file: Gentoo
`/usr/lib/systemd/system/logrotate.timer`, `logrotate.service`	Daily schedule on systemd systems
`/etc/cron.daily/logrotate`	Daily cron job (Gentoo with OpenRC; on Debian and Ubuntu only used without systemd)