How To Manage Log Files With Logrotate On Ubuntu 12.10

Published on April 18, 2013


How To Manage Log Files With Logrotate On Ubuntu 12.10

About Logrotate

Logrotate is a utility/tool that manages activities like automatic rotation, removal and compression of log files in a system. This is an excellent tool to manage your logs conserve precious disk space. By having a simple yet powerful configuration file, different parameters of logrotation can be controlled. This gives complete control over the way logs can be automatically managed and need not necessitate manual intervention.


As a prerequisite, we are assuming that you have gone through the article on how to set up your droplet or VPS. If not, you can find the article here. This tutorial requires you to have a VPS up and running and have you log into it.

Setup Logrotate

Step 1—Update System and System Packages

Run the following command to update the package lists from apt-get and get the information on the newest versions of packages and their dependencies.

sudo apt-get update

Step 2—Install Logrotate

If logrotate is not already on your VPS, install it now through apt-get.

sudo apt-get install logrotate

Step 3 — Confirmation

To verify that logrotate was successfully installed, run this in the command prompt.


Since the logrotate utility is based on configuration files, the above command will not rotate any files and will show you a brief overview of the usage and the switch options available.

Step 4—Configure Logrotate

Configurations and default options for the logrotate utility are present in:


Some of the important configuration settings are : rotation-interval, log-file-size, rotation-count and compression.

Application-specific log file information (to override the defaults) are kept at:


We will have a look at a few examples to understand the concept better.

Step 5—Example

An example application configuration setting would be the dpkg (Debian package management system), that is stored in /etc/logrotate.d/dpkg. One of the entries in this file would be:

/var/log/dpkg.log {
	rotate 12
	create 644 root root

What this means is that:

  • the logrotation for dpkg monitors the /var/log/dpkg.log file and does this on a monthly basis - this is the rotation interval.
  • 'rotate 12' signifies that 12 days worth of logs would be kept.
  • logfiles can be compressed using the gzip format by specifying 'compress' and 'delaycompress' delays the compression process till the next log rotation. 'delaycompress' will work only if 'compress' option is specified.
  • 'missingok' avoids halting on any error and carries on with the next log file.
  • 'notifempty' avoid log rotation if the logfile is empty.
  • 'create <mode> <owner> <group>' creates a new empty file with the specified properties after log-rotation.

Though missing in the above example, 'size' is also an important setting if you want to control the sizing of the logs growing in the system.

A configuration setting of around 100MB would look like:

size 100M

Note that If both size and rotation interval are set, then size is taken as a higher priority. That is, if a configuration file has the following settings:

size 100M

then the logs are rotated once the file size reaches 100M and this need not wait for the monthly cycle.

Step 6—Cron Job

You can also set the logrotation as a cron so that the manual process can be avoided and this is taken care of automatically. By specifying an entry in /etc/cron.daily/logrotate , the rotation is triggered daily.

Step 7—Status Check and Verification

To verify if a particular log is indeed rotating or not and to check the last date and time of its rotation, check the /var/lib/logrotate/status file. This is a neatly formatted file that contains the log file name and the date on which it was last rotated.

cat /var/lib/logrotate/status 

A few entries from this file, for example:

"/var/log/lpr.log" 2013-4-11
"/var/log/dpkg.log" 2013-4-11
"/var/log/pm-suspend.log" 2013-4-11
"/var/log/syslog" 2013-4-11
"/var/log/mail.info" 2013-4-11
"/var/log/daemon.log" 2013-4-11
"/var/log/apport.log" 2013-4-11

Congratulations! You have logrotate installed in your system. Now, change the configuration settings as per your requirements.

Try 'man logrotate' or 'logrotate -?' for more details.

Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.

Learn more about our products

About the authors
Default avatar


Still looking for an answer?

Ask a questionSearch for more help

Was this helpful?

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Kamal Nasser
DigitalOcean Employee
DigitalOcean Employee badge
August 27, 2013

@rajnish4internet: According to the manual/logrotate’s doc files:

<pre> rotate count Log files are rotated <count> times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather then rotated.</pre>

hi team, Thanks for posting such a clear cut explanation docs . it will help to understand basic concept of LOGROTATE. i have one doubt about it like in doc , it is mentioned that What this means is that:

the logrotation for dpkg monitors the /var/log/dpkg.log file and does this on a monthly basis - this is the rotation interval.

'rotate 12' signifies that 12 days worth of logs would be kept. 

i think rotate 12 means it will keep 12 old log files(i.e 12 month old log files kept) ,because how it will possible , log rotation is monthly based and rotate will keep only 12 day logs file.

Hello! When I type in “/etc/logrotate.conf” I get “Permission Denied”. How do I go about getting around this? I should have all access to it as admin.

Thank you.

‘rotate 12’ signifies that 12 days worth of logs would be kept. Isn’t really correct.actually it means it keeps 12 log files before deleting the old log files, not 12 days worth of log files. as an example in here since the rotation time is monthly, once per month a new log file is created, and the old log file’s extension is changed to something else in order to retain it as a backup, likewise 12 files are kept. so there will be 12 months worth of log files are retained, it means 1 year worth of log files. and if the rotation interval is daily, then it’s 12 days worth of log files.

delaycompress isn’t even explained properly, what it means, delay the compression until the 2nd rotation. so if there are 12 files, one file is access.log, second file is access.log.1 , and then series of compressed access files with gzip. So please update the tutorial, this is really misleading.

Excellent help article, really clear and concise. Thank you

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Join the Tech Talk
Success! Thank you! Please check your email for further details.

Please complete your information!

Featured on Community

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel