How Logrotate Prevents Full Disks on Debian

On Debian systems, active services continuously generate log data that can eventually consume all available disk space, leading to system instability or crashes. The logrotate utility solves this problem by automating the lifecycle of log files through scheduled rotation, compression, truncation, and deletion. This article explains the exact mechanisms logrotate uses to manage file growth, its default configuration structure on Debian, and how to tune its settings to safeguard storage capacity.

The Problem with Unmanaged Logs

System daemons, web servers, and user applications write constant status and error events to /var/log. Without intervention, files such as syslog, kern.log, or web access logs grow indefinitely. When storage fills up:

  • Services fail to write new data and may crash.
  • Critical operations, such as package updates or database writes, are blocked.
  • System responsiveness degrades significantly.

How Logrotate Manages Disk Usage

logrotate is installed by default on Debian and operates non-interactively to enforce log management policies through several key actions:

1. File Rotation

Instead of letting a single log file expand endlessly, logrotate closes the active log and renames it. For example, /var/log/syslog becomes /var/log/syslog.1. A new, empty /var/log/syslog is created so the service can continue logging without interruption.

2. Compression

Historical logs are rarely accessed but must be retained for auditing. logrotate compresses older archives using tools like gzip (controlled by the compress directive). This reduces the disk footprint of text logs by up to 90%. When configured with delaycompress, it defers compression of the most recent backup until the next cycle to avoid conflicts with daemons still writing to the old file descriptor.

3. Removal of Old Logs

Debian administrators define retention limits using the rotate directive (e.g., rotate 7 keeps seven rotated logs). When a new rotation occurs and the limit is exceeded, the oldest log file (such as syslog.7.gz) is permanently unlinked, freeing storage space automatically.

4. Size and Time Triggers

Rotations can be triggered either on a fixed time interval (daily, weekly, monthly) or based on size thresholds:

  • Time-based: Rotates logs periodically regardless of size, providing predictable intervals.
  • Size-based: Directives like size 100M or maxsize 500M force a rotation once a file reaches a defined limit, preventing sudden log surges from overwhelming the disk before the next scheduled cycle.

How It Runs on Debian

logrotate does not run as a continuous daemon. Instead, modern Debian installations execute it daily via a systemd timer (logrotate.timer) or a daily cron job located at /etc/cron.daily/logrotate. When triggered, it reads configuration rules and acts on files that meet the criteria.

The configuration on Debian is split into two components:

  • /etc/logrotate.conf: Contains global defaults (such as weekly rotation, compression behavior, and global file permissions).
  • /etc/logrotate.d/: Contains application-specific configuration snippets for installed packages (e.g., Nginx, Apache, APT, or rsyslog).

Key Directives for Disk Protection

To aggressively protect disk space, key directives can be applied inside /etc/logrotate.d/ configurations:

  • compress: Enables compression for rotated logs.
  • rotate <number>: Sets the maximum number of retained archives.
  • maxsize <size>: Rotates the file if it exceeds this size, even if the regular time interval has not passed.
  • minsize <size>: Prevents premature rotation of small files until they reach a minimum size.
  • missingok: Prevents errors if a log file does not exist, keeping execution smooth.
  • notifempty: Skips rotation if the log file contains no data.

By automating the compression of historical records and deleting the oldest entries beyond a fixed retention window, logrotate creates a predictable ceiling on disk usage for log storage across the Debian operating system.