Logrotate and its mysteries

We can find on the Internet many articles explaining how to configure logrotate and all the available options, but very few sites explain on what logrotate is based to determine when is each hour or each day, is each day at 00:00, at 10:30?. In this article we will clarify all these doubts and how to change these moments.

Logrotate relies on cron to execute scheduled tasks, every 10 minutes run-crons is executed, every 10 minutes it is checked if there is something scheduled to be executed every hour, day, week, month:

cat /etc/crontab

*/10 * * * * root test -x /usr/sbin/run-crons && /usr/sbin/run-crons

This script is responsible for executing crons every hour, day, week, month:

for BASE in hourly daily weekly monthly ; do
    CRONDIR=/etc/cron.${BASE}

for SCRIPT in $CRONDIR/* ; do

Every hour, day, week, month, /usr/sbin/logrotate /etc/logrotate.conf is executed, in this example we show the daily execution:

cat /etc/cron.daily/logrotate

#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
 /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

Logrotate looks at the configuration of how often each file should be rotated and based on /var/lib/logrotate.status it knows the last time it was rotated, according to this information it proceeds to rotate or not:

cat /var/lib/logrotate.status

logrotate state -- version 2
"/var/log/filelog1" 2017-6-9-3:10:1
"/var/log/filelog2" 2017-5-18-3:10:1
"/var/log/filelog3" 2017-6-1-3:10:2

NOTE: In some systems it may be in /var/lib/misc/logrotate.status

We can see how the rotation time coincides with the one saved in the file /var/lib/logrotate.status.

ls -la /var/log/filelog1*

-rw-rw-r-- 1 root root 94015881 jun 9 10:18 /var/log/filelog1
-rw-rw-r-- 1 root root 471797517 abr 26 03:10 /var/log/filelog1-20170426
-rw-rw-r-- 1 root root 517655380 abr 27 03:10 /var/log/filelog1-20170427
-rw-rw-r-- 1 root root 500113058 abr 28 03:10 /var/log/filelog1-20170428

If we want a file to be rotated at a different time, we just need to edit the file: /var/lib/logrotate.status.

As a quick summary, every 10 minutes, logrotate attempts to rotate all the files configured in it, but only if the date of the last rotation in /var/lib/logrotate.status allows it.