How To Set Up Log Rotation With logrotate on Ubuntu

If an application writes to its own log file instead of going through syslog or journald, that file grows unbounded unless something rotates it — left unmanaged, it will eventually fill the disk, taking down every service on the box when the filesystem hits 100%. Ubuntu already runs logrotate once a day to rotate the logs it knows about (apt, dpkg, ufw, and others under /etc/logrotate.d/) — this tutorial adds a rotation config for a log file logrotate doesn't know about yet: a custom application's own log.

Step 1 — Confirm logrotate is installed and scheduled

logrotate ships pre-installed on Ubuntu 22.04 and 24.04. Confirm the binary is present and check what triggers it:

logrotate --version
systemctl list-timers | grep logrotate

On current Ubuntu releases, a systemd timer (logrotate.timer) fires logrotate.service once a day, which runs /usr/sbin/logrotate against /etc/logrotate.conf. That file includes /etc/logrotate.d/, so anything you drop into that directory gets picked up on the next daily run automatically — you don't need to register it anywhere else. If the timer isn't listed, check for a legacy /etc/cron.daily/logrotate entry instead; either way, you don't need to create the schedule yourself, only the config for your app.

Step 2 — Identify the log file that needs rotation

For this tutorial, assume an application running as the myappuser user (group myappgroup) that writes to /var/log/myapp/app.log with no rotation configured. Confirm the file exists and check its current size and ownership:

ls -la /var/log/myapp/

Substitute your own log path, service user, and group throughout this tutorial — logrotate needs the exact ownership so the recreated log file stays readable and writable by the process producing it.

Step 3 — Create the logrotate configuration

Configs in /etc/logrotate.d/ are plain text, one file per application. Created with sudo, they end up owned by root and writable only by root, but — like the rest of /etc — world-readable by default: any local user on the box can read the file. That's fine for the directives below, but don't put a secret directly in a postrotate command in one of these files; anything sensitive needs tighter permissions than this directory provides. Create the file:

sudo nano /etc/logrotate.d/myapp

Add the following:

/var/log/myapp/app.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    create 0640 myappuser myappgroup
    sharedscripts
    postrotate
        systemctl reload myapp >/dev/null 2>&1 || true
    endscript
}