{
  "id": 1084028,
  "title": "Why logrotate silently does nothing and how to actually debug it",
  "url": "https://urgent.news/2026/08/15/why-logrotate-silently-does-nothing-and-how-to-actually-debug-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-15T17:04:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/schiff_heimlich/why-logrotate-silently-does-nothing-and-how-to-actually-debug-it-2gd"
  },
  "original_language": "en",
  "account": "Logrotate misconfigurations often go unnoticed, silently failing rather than failing loudly. A common issue arises with the copytruncate directive, which copies a log file and truncates it in place. On a busy server, this can lead to dropped log entries. The solution is to use the postrotate approach, which reloads the process cleanly without race conditions or dropped lines.\n\nHowever, logrotate returning a 0 exit code doesn't necessarily mean the rotation was successful. It could be due to various reasons such as missing files, wrong paths, permission issues, or config directives that don't apply. To verify the actual state, run logrotate with the -d flag in debug mode, which prints what it would do without executing it. This is crucial before applying any config changes.\n\nWhen debugging, focus on key areas: renaming logs, empty log warnings (indicating missing or zero-size source files), and error strings (pointing to permission or path issues). If you see \"log needs rotating\" without \"renaming,\" it indicates the maxsize or rotations-per-day limit has been reached, and the file was skipped intentionally.\n\nThe most common cause of disk fill-ups isn't malicious activity but rather a logrotate config that lacked compress on a high-volume file, going unnoticed for months due to a lack of disk alerts. The second most common issue is a process holding onto a file descriptor after logrotate has moved the file, causing the rotated file to remain on disk until the process restarts. Using the command \"lsof +L1\" can quickly identify this problem. In summary, verify postrotate hooks, test logrotate with -d before deploying configs, and include \"lsof +L1\" in your disk-full checklist.",
  "summary": "A config that doesn't error is not a config that works. logrotate misconfigurations don't fail loudly. They fail silently. You only find out when /var/log is 100% full and something crashed. The copytruncate race condition The copytruncate directive exists because some processes don't respond to SIGHUP. Instead of telling the process to reopen its log, logrotate copies the file and truncates it…",
  "key_points": [
    "Logrotate misconfigurations often go unnoticed, silently failing",
    "Copytruncate directive can cause dropped log entries on busy servers",
    "Use postrotate approach and logrotate -d for debugging"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}