Ubuntu 22.04 LTS Logrotate Fails and /var Grows Unbounded

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk usage in /var grows rapidly because logs are not rotated. Services may fail when filesystem fills, affecting uptime and observability retention.

Environment & Reproduction

Ubuntu 22.04 LTS with custom logrotate snippets added for application logs. Reproduce by introducing invalid directive or missing postrotate command context.

Root Cause Analysis

logrotate stops processing when it hits malformed config or inaccessible files. As a result, high-volume logs continue growing without truncation or archival.

Quick Triage

Identify largest log paths and run logrotate in debug mode to capture parse failures before deleting any files.

Step-by-Step Diagnosis

Inspect custom rotation stanzas, state file health, and file ownership. Confirm postrotate scripts can execute successfully under expected context.

Solution – Primary Fix

Correct invalid config directives, ensure file ownership is compatible, and run forced logrotate cycle to reclaim space and re-establish schedule.

Solution – Alternative Approaches

Move noisy logs to journald with retention controls, centralize logs in external stack, or use application-level rotation where compatible.

Verification & Acceptance Criteria

Rotated files appear with expected retention count, active logs truncate correctly, and /var usage trend stabilizes after scheduled cycles.

Rollback Plan

Restore previous logrotate policy from backup, rerun debug validation, and temporarily increase disk capacity if immediate cleanup is incomplete.

Prevention & Hardening

Lint logrotate snippets in CI, monitor /var growth alerts, and document ownership plus postrotate requirements for each service.

Related Errors & Cross-Refs

Commonly associated with stale PID references in postrotate scripts, permission-denied on app logs, and timer not enabled after image provisioning.

Related tutorial: View the step-by-step tutorial for Ubuntu 22.04 LTS.

View all Ubuntu 22.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See logrotate(8), Ubuntu logging maintenance guides, and systemd timer documentation for resilient log lifecycle management.