5 Log rotation (logrotate)

logrotate is a program (not a daemon) that “rotates, compresses and mails system logs” (from its man page description.

This program is controled by its configuration file, usually /etc/logrotate.conf. However, the majority of configurations are specified by files in the directory /etc/logrotate.d. All files in this directory are read as if they are a part of /etc/logrotate.conf. This mechanism makes it easier for each individual program to add its own log rotation configuration without having to change the main file /etc/logrotate.conf.

logrotate and syslogd do not have any direct relationship. Their only interaction is that one may create the files to be rotated, while the other one does the rotation. logrotate is typically triggered by crond. Debian systems include the necessary file at /etc/cron.daily/logrotate. This means that a default Debian system runs logrotate every day.

logrotate has a lot of flexibilities, including the ability to specify what to do before and after the rotation. This makes it possible run some analysis code when the log files are rotated.