Logrotate

Logrotate is a utility for managing log files on Unix-like systems. Its primary purpose is to rotate, compress, remove and mail system logs to prevent log files from growing too large and exhausting disk space. It is widely used across Linux distributions and other Unix-like environments and is typically run automatically by cron or a systemd timer.

Configuration is centralized in /etc/logrotate.conf with per-package configurations in /etc/logrotate.d/. The main file defines global defaults and may include additional files from the include directive. Each log group specifies a path and a set of directives such as daily, weekly, or monthly for rotation frequency; rotate to indicate how many archived versions to retain; compress to save space; delaycompress to delay compression by one rotation; missingok to skip missing files; notifempty to skip zero-length logs; create to create new log files with mode and ownership. A postrotate script can be supplied to tell a daemon to reopen its log files after rotation.

Logrotate keeps track of when each log was rotated using a state file, typically /var/lib/logrotate/status, so it doesn't rotate logs more than intended. It can also use prerotate and postrotate blocks and sharedscripts to coordinate actions across multiple logs.

Common usage: distros install a daily cron job or a systemd timer that runs logrotate with /etc/logrotate.conf. Administrators may add per-application rules in /etc/logrotate.d, such as for nginx, Apache, or system logs. A simple example rotates /var/log/nginx/*.log daily, keeps 14 old logs, compresses, and reloads the daemon after rotation.

Limitations: Logrotate does not itself rewrite log statements; it relies on the services to reopen log files after rotation. It is a batch rotation tool, not a real-time log manager.