Packages, services, and logs / Stage 12 of 13 · step 7 of 9

Set up log rotation

~20 min

Not running Starting usually ~20 s

Situation

The myapp service appends a line to /var/log/myapp/app.log every two seconds. The log has no rotation: the file is already large and keeps growing. It needs proper rotation with logrotate.

Task

A rule sits in its own file, /etc/logrotate.d/myapp, covers /var/log/myapp/app.log and parses in logrotate without errors.
Under this rule the log rotates daily, seven old files are kept, and old files are compressed.
One rotation has already run: the log's old contents sit in an archive next to it.
After the rotation the myapp service keeps writing to /var/log/myapp/app.log.
Later rotations by this rule do not take the service's writes away from app.log either.

Constraints

Do not change the myapp service or its program, /usr/local/bin/myapp.
Do not delete the log's old contents.

The tools you need are already installed. There's no internet on this machine.

Lab goals

0 of 5

The /etc/logrotate.d/myapp rule covers /var/log/myapp/app.log and parses without errors — not checked yet
Under the rule the log rotates daily, seven old files are kept and old files are compressed — not checked yet
Rotation has run — the log's old contents sit in an archive — not checked yet
After rotation the myapp service writes to /var/log/myapp/app.log — not checked yet
Later rotations by the rule do not take the service's writes away from app.log either — not checked yet

Hints

0 of 3 open · they open one at a time

Hint 1

Show the solution after 3 failed checks

Logs and audit · picked for this lab

Log rotation with logrotate

Cheat sheet

$_ — insert into the terminal

sudo logrotate -d /etc/logrotate.conf dry run (changes nothing)
sudo logrotate -f /etc/logrotate.d/nginx force it now
cat /var/lib/logrotate/status rotation history

Globally in /etc/logrotate.conf, per service in /etc/logrotate.d/<service>:

/var/log/myapp/*.log {
    daily                 # how often (daily/weekly/monthly) — or size 100M
    rotate 14             # keep 14 copies
    compress              # compress old ones (.gz)
    delaycompress         # don't compress the most recent rotated file (still being appended to)
    missingok             # fine if the log is missing
    notifempty            # don't rotate empty files
    dateext               # date suffix (file-20260101) instead of .1
    create 0640 myapp myapp   # create a new log with these permissions/owner
    su myapp myapp            # run as this user (if the directory isn't root's)
    sharedscripts             # run postrotate once for all files in the pattern
    postrotate
        systemctl reload myapp >/dev/null 2>&1 || true
    endscript
}

Directives

Directive	Meaning
`daily/weekly/monthly`	the period
`size 100M`	rotate by size (instead of, or together with, the period)
`rotate N`	how many copies to keep
`compress`/`delaycompress`	compress / defer compression by one cycle
`copytruncate`	copy and truncate (if the service can't reopen its log file)
`postrotate…endscript`	a command to run after rotation (reload the service)
`maxage N`	delete files older than N days

postrotate (reload/reopen) or copytruncate is required for the service to start writing to the new file.

Commands

bash

sudo logrotate -d /etc/logrotate.conf     # debug/dry-run: what it WOULD do (no changes)
sudo logrotate -v /etc/logrotate.conf     # a verbose run
sudo logrotate -f /etc/logrotate.d/nginx  # FORCE rotation now
cat /var/lib/logrotate/status             # when each file was last rotated
systemctl status logrotate.timer          # is the timer active

The log keeps growing, no rotation happens

Is there a config in /etc/logrotate.d/? logrotate -d (dry-run) shows whether the file is picked up.
Is the timer active? systemctl status logrotate.timer.
An error in one config file blocks the rest — check the output of -d or journalctl -u logrotate.

After rotation the service keeps writing to the old (deleted) file

There's no postrotate with a reload, and no copytruncate. The service holds the old file descriptor open, so the space isn't freed (see disk-usage: lsof +L1). Add a reload or copytruncate.

"error: skipping … because parent directory has insecure permissions"

logrotate is complaining about permissions/ownership of the log directory. Add su user group to the block.

The disk is already full of logs

Urgent fix: run logrotate -f manually, compress or delete old files; then set up proper rotation and limits (disk-usage).