Rotate Linux Logs with logrotate and Verify Application Writes

logrotate rotates, compresses and expires selected log files. It is not a real-time size limiter or an off-server archive service. A rotation rule only takes effect when logrotate is invoked, and an application may need a documented signal or reopen action before it writes to the replacement file.

Inspect existing management first

Check your supported distribution’s installed logrotate manual, global configuration, included fragments and scheduler. Many systems use a systemd timer; others use cron. Do not add a second scheduler or duplicate a package-managed rule for the same logs. Systemd journal storage has its own controls and is not managed merely by adding a text-file glob.

Practice on a synthetic log

This isolated Bash fixture writes a single test log under a fresh private directory. It does not touch application logs. The example deliberately omits ownership changes and application restart hooks.

umask 077
lab=$(mktemp -d)
cd "$lab" || exit 1
printf 'synthetic log entry\n' > app.log
printf '%s\n' \
  "\"$lab/app.log\" {" \
  '    size 1' \
  '    rotate 2' \
  '    missingok' \
  '    notifempty' \
  '    compress' \
  '    delaycompress' \
  '    create 0600' \
  '}' > lab.conf
logrotate --debug --state "$lab/state" "$lab/lab.conf"
test -f app.log
test ! -e app.log.1
logrotate --force --state "$lab/state" "$lab/lab.conf"
test -f app.log.1
grep -F 'synthetic log entry' app.log.1
test ! -s app.log

--debug inspects the proposed operation without rotating logs or updating the state. The following --force actually rotates this fixture. Do not run that force step against an unreviewed production configuration.

Understand the rule

• size 1 is a tiny fixture threshold in bytes, checked at invocation; it is not a production recommendation. Choose time/size controls and their precedence using the installed manual.
• rotate 2 limits retained rotated generations for this rule. Real retention also depends on invocation and other directives; it is not a compliance guarantee.
• delaycompress delays compression of the most recently rotated log until a subsequent cycle, not the active log.
• create 0600 creates a replacement with restricted mode. Production owner/group must match the actual writer and service policy.

Coordinate with the application

After renaming, a running process can continue writing to its old open file. Use the application’s or package’s documented reopen procedure in an appropriate postrotate hook. Do not replace that with a guessed restart of every service. copytruncate has a copy-to-truncate race in which writes can be lost; it is not a zero-loss solution, and create is not used the same way with it.

For a live rollout, preserve the current rule, inspect its debug output and test in a maintenance plan. Confirm active writes continue, rotated files contain expected data, permissions remain appropriate and the real scheduler runs. Protect logs from unauthorized access and arrange independent storage if the recovery or audit requirement extends beyond the host. Compression and local rotation do not encrypt or independently preserve evidence.

Reference: upstream logrotate manual.

Reviewed October 15, 2026. The debug and forced rotation sequence was executed only on a synthetic log in a disposable container. No customer logs or application reopen hooks were tested.