Simple definition
logrotate is a Linux utility that automates log rotation, compression, retention, and deletion of older log files.
Technical definition
Rules can be defined in /etc/logrotate.conf and /etc/logrotate.d/. Rotation can depend on size, schedule, generation count, and directives such as compress, postrotate, or, when appropriate, copytruncate.
How it works / role
At each scheduled run, logrotate evaluates the log state and matching rules. When rotation is due, it renames or recreates the file, can compress it, and may run an action that tells the service to reopen its log. A state file prevents unnecessary repeated rotations.
What is it used for?
Prevent a log file from filling the filesystem while retaining a useful history.
Practical example
Nginx logs are rotated weekly, compressed, and kept for several generations; Nginx is then signaled to reopen its log files.
Common issues
- Service keeps writing to the old file after rotation
- Rule never runs or the state file is inconsistent
- Retention is too short for audit requirements
- copytruncate can lose a small amount of data during copying
Related terms
Key takeaway: Reliable log rotation must manage file size, retention, and the way the application reopens its log.