RHEL 8 – logrotate Misconfiguration Leads to /var/log Disk Exhaustion

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Filesystem fills from unrotated logs, causing service failures and potential data loss.

Environment & Reproduction

Triggered by invalid logrotate syntax, missing postrotate scripts, or disabled timer/cron path.

Root Cause Analysis

Rotation process fails silently or skips target logs due to configuration drift.

Quick Triage

Check disk usage, validate logrotate config, and inspect journalctl for timer execution errors.

Step-by-Step Diagnosis

Run logrotate in debug mode and verify permissions on large log files.

Solution – Primary Fix

Fix rotation rules, force one-time rotation safely, and ensure timer/service schedule is active.

Solution – Alternative Approaches

Move verbose app logs to dedicated volume and enforce application-level log limits.

Verification & Acceptance Criteria

Disk utilization declines, rotated archives appear, and scheduled rotations run as expected.

Rollback Plan

Restore prior logrotate configs from backup if new policy truncates needed retention.

Prevention & Hardening

Include log growth alerts and periodic config linting in routine operations.

Related Errors & Cross-Refs

No space left on device, logrotate status stale, failed postrotate script.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL 8 logging stack, logrotate policy design, and operations monitoring references.