logrotation

Logrotation is the automated management of log files to prevent unbounded growth and to organize archival data. It involves periodically archiving the current log, creating a new log file, and often compressing and deleting older entries according to a retention policy. The aim is to keep disk usage predictable, speed up log access and backup, and facilitate compliance with data retention requirements.

Rotation can be time-based (daily, weekly, monthly) or size-based (rotate when a log reaches a size threshold), and many configurations combine both. A typical rotation sequence includes renaming the active log (for example app.log to app.log.1), creating a new empty app.log, optionally compressing older files (for example app.log.1.gz), and removing or archiving files beyond the retention limit. Retention policies specify how many rotated files to keep and when to purge them.

Implementation is provided by utilities such as logrotate on Unix-like systems, rotatelogs from Apache, and various platform-specific tools like newsyslog on macOS. Some environments use the built-in rotation of the system logger (for example systemd-journald) which may also apply compression and aging. Post-rotation steps commonly signal services to reopen their log files (for example sending SIGHUP) to ensure new data is written to the new file; where programs do not support reopening, copytruncate may be used as a workaround.

Common considerations include ensuring atomic rename semantics, handling multiple processes writing to the same log, and enforcing proper permissions and location. Effective logrotation balances disk usage, performance, and the need to retain useful diagnostic data.