Debian 12 – logrotate misconfiguration causes runaway log growth – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Log files grow uncontrollably, consuming disk and destabilizing services.

Environment & Reproduction

Often introduced by invalid custom logrotate snippets.

sudo logrotate -d /etc/logrotate.conf
df -h
ls -lh /var/log | head

Root Cause Analysis

Syntax errors or missing postrotate actions prevent rotation from completing.

Quick Triage

Run debug mode and inspect state file behavior.

sudo logrotate -d /etc/logrotate.conf
cat /var/lib/logrotate/status | tail -n 40
grep -RIn 'rotate|daily|size' /etc/logrotate.d

Step-by-Step Diagnosis

Find failing stanza and confirm ownership/permission assumptions.

grep -RIn "error|bad" /var/log 2>/dev/null | tail -n 20
namei -l /var/log
sudo logrotate -f /etc/logrotate.conf

Solution – Primary Fix

Repair broken rotate rules and force a clean rotation cycle.

sudo cp -a /etc/logrotate.d /var/tmp/logrotate.d.bak.$(date +%s)
sudoedit /etc/logrotate.d/
sudo logrotate -f /etc/logrotate.conf
df -h

Solution – Alternative Approaches

Apply size-based rotation for high-volume logs.

echo '/var/log/.log { size 100M rotate 7 compress missingok notifempty }' | sudo tee /etc/logrotate.d/
sudo logrotate -f /etc/logrotate.conf
ls -lh /var/log

Verification & Acceptance Criteria

Rotation succeeds without errors and log growth is bounded.

sudo logrotate -d /etc/logrotate.conf
ls -lh /var/log | head
df -h

Rollback Plan

Restore previous logrotate snippets from backup.

sudo rsync -aHAX /var/tmp/logrotate.d.bak.*/ /etc/logrotate.d/
sudo logrotate -f /etc/logrotate.conf
df -h

Prevention & Hardening

Lint custom rotate files before deployment and monitor disk trends.

sudo logrotate -d /etc/logrotate.conf
systemctl status logrotate.timer
df -h

Related Errors & Cross-Refs

Often linked with root filesystem saturation and journal retention misconfiguration.

Related tutorial: View the step-by-step tutorial for Debian 12.

View all Debian 12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian logrotate and log retention best-practice references.