I am new to sysadmining and have a few questions:

  1. Where and how is the logrotate procedure initaited by the system?
  2. What time of day are my "daily" rotated logfiles being rotated?
  3. Do the prerotate commands run for each log file matched in a *.log entry?

Thank you

  • You should get some idea from the timestamps on the rotated log files. Jun 2, 2010 at 14:41

3 Answers 3


1) My logrotate on my older Hardy install is identical to Mike's answer

2) Looking at the /etc/crontab file, cron.daily is run at 6:25am on my install

3) If the pre-rotate commands are assigned to a a pattern, and the log files match that pattern, then yes


from https://help.ubuntu.com/community/LinuxLogFiles :

Typically, logrotate is called from the system-wide cron script /etc/cron.daily/logrotate, and further defined by the configuration file /etc/logrotate.conf. Individual configuration files can be added into /etc/logrotate.d (where the apache2 and mysql configurations are stored for example).

The files involved are:


As with Matt, cron.daily jobs are started at 6:25am on my system, but actual execution time will vary depending on jobs in cron.daily, system load, etc..

/etc/cron.daily/logrotate runs logrotate using the logrotate.conf file:

"/usr/sbin/logrotate /etc/logrotate.conf"

/etc/logrotate.conf points to the /etc/logrotate.d directory:

"include /etc/logrotate.d"

/etc/logrotate.d contains individual scripts for specific log files
For these files, the actions in curly braces (rotate, compress, etc.) are performed on the files defined at the beginning of each block. Wildcards are allowed, so something like '/var/log/*log' should affect all files in /var/log/ that end with the .log suffix.
If prerotate is one of the keywords used in the block that belongs to '/var/log/*log', then those files will have the prerotate commands run on them, but "only if the log will actually be rotated."(from man logrotate)


look at the following


ls /etc/cron.daily

In RedHat is is

  • OK, i see the file in cron.daily. A quick check to /etc/crontab shows when that is scheduled to run. Thank you
    – OoJoo
    Jun 2, 2010 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy