When configuring logrotate with the daily option, many developers assume logs will rotate exactly every 24 hours. However, the actual behavior depends on both cron execution timing and internal state tracking.

logrotate maintains rotation history in /var/lib/logrotate/status (location may vary by OS). This file records:

"/var/log/nginx/access.log" 2024-3-15-12:0:0
"/var/log/syslog" 2024-3-16-6:30:0

The timestamp indicates when each log was last rotated. During execution, logrotate compares:

1. Current system time
2. Last rotation timestamp
3. Cron schedule interval

A typical daily cron job looks like:

0 0 * * * /usr/sbin/logrotate /etc/logrotate.conf

Even if you manually run logrotate earlier, it won't rotate daily logs unless:

• 24 hours have passed since last rotation AND
• The cron-scheduled time window is active

To override the daily check during testing:

logrotate -f /etc/logrotate.conf

Or for specific logs:

logrotate -vf /etc/logrotate.d/nginx

Check the status file with:

cat /var/lib/logrotate/status | grep -A2 "yourlogfile"

Example debug output:

reading config file /etc/logrotate.d/nginx
Considering log /var/log/nginx/access.log
  Now: 2024-03-16 14:00
  Last rotated at 2024-03-15 00:00
  daily rotations are deferred (need 24h)

To customize rotation timing while keeping daily semantics:

/var/log/custom.log {
    daily
    rotate 7
    dateext
    dateformat -%Y%m%d-%H%M%S
    create 0640 www-data adm
    sharedscripts
    postrotate
        /usr/bin/systemctl reload custom.service
    endscript
}

---

When examining logrotate's daily rotation behavior, the key mechanism isn't based on calendar days but rather on:

1. The last rotation timestamp stored in /var/lib/logrotate/status
2. System time comparison when executed
3. The cron schedule configuration

logrotate maintains state in /var/lib/logrotate/status (location may vary by distro). This file records the last rotation time for each log file configuration. Example entry:

"/var/log/nginx/access.log" 2024-2-15-12:0:0

Most systems schedule logrotate via cron.daily. A typical Ubuntu configuration in /etc/cron.daily/logrotate:

#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

To manually test daily rotation criteria without waiting for cron:

# Force a rotation check (won't rotate if not time)
logrotate -d /etc/logrotate.conf

# Force rotation regardless of timestamp
logrotate -f /etc/logrotate.d/nginx

Example configuration for strict calendar-day rotation in /etc/logrotate.d/custom:

/var/log/myapp/*.log {
    daily
    rotate 7
    dateext
    dateformat -%Y%m%d
    missingok
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        systemctl reload myapp.service >/dev/null 2>&1 || true
    endscript
}

Key diagnostic commands:

# Check last rotation times
cat /var/lib/logrotate/status

# Verify cron schedule
ls -la /etc/cron.daily/

# Test configuration syntax
logrotate --debug /etc/logrotate.conf

For applications needing precise rotation control, consider combining size and time:

/var/log/critical/*.log {
    daily
    size 100M
    rotate 10
    compress
    delaycompress
    sharedscripts
    extension .log
}