In Ubuntu 10.04, logrotate is triggered through a daily cron job located at /etc/cron.daily/logrotate. The system uses anacron to ensure rotation occurs even if the server was down during the scheduled time. The actual execution command is:

#!/bin/sh
test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

The exact rotation time depends on when the cron.daily jobs execute, which is controlled by /etc/crontab:

25 6    * * *   root    test -x /usr/sbin/anacron || run-parts --report /etc/cron.daily

This means daily rotations typically occur at 6:25 AM. You can verify your system's schedule with:

grep cron.daily /etc/crontab

When using wildcards like *.log, prerotate scripts execute separately for each matched file. Consider this example configuration:

/var/log/app/*.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    sharedscripts
    prerotate
        /usr/bin/logger -t logrotate "Prerotating $1"
    endscript
    postrotate
        /etc/init.d/app restart > /dev/null
    endscript
}

The sharedscripts directive is crucial - when present, prerotate/postrotate runs once total; when absent, they run per-file. Example output would show:

Prerotating /var/log/app/access.log
Prerotating /var/log/app/error.log

To manually test rotation with debug output:

logrotate -dv /etc/logrotate.conf

Force immediate rotation (bypassing normal schedule):

logrotate -f /etc/logrotate.d/your_config

Check last rotation time:

grep logrotate /var/lib/logrotate/status

In Ubuntu 10.04, logrotate is typically executed daily via cron. The system maintains a cron job in /etc/cron.daily/logrotate which contains:

#!/bin/sh
test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

The exact execution time depends on your system's anacron configuration (for desktop installations) or standard cron scheduling (for servers). You can check the actual schedule by examining:

ls -l /etc/cron.daily/logrotate
cat /etc/crontab

The "daily" rotation occurs during the cron.daily execution window, which by default runs between 6:25 AM and 8:25 AM on Ubuntu systems. This randomized delay prevents all systems from hitting repositories simultaneously.

To verify when your last rotation occurred:

grep logrotate /var/log/syslog | tail -n 5

When using wildcards like *.log, prerotate scripts execute once for the entire pattern match, not per individual file. Consider this configuration:

/var/log/app/*.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    sharedscripts
    prerotate
        /usr/bin/appctl quiesce
    endscript
    postrotate
        /usr/bin/appctl resume
    endscript
}

The sharedscripts directive (default in newer versions) ensures the prerotate/postrotate executes only once. Without it, the scripts would run for each matched file.

For complex scenarios with multiple patterns:

/var/log/nginx/*.log /var/log/nginx/*.log.1 {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    prerotate
        if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
            run-parts /etc/logrotate.d/httpd-prerotate; \
        fi
    endscript
    postrotate
        invoke-rc.d nginx rotate >/dev/null 2>&1
    endscript
}

To test your configuration without waiting for cron:

logrotate -d /etc/logrotate.conf       # Dry run
logrotate -vf /etc/logrotate.d/nginx   # Force run with verbose output

Check state tracking in:

cat /var/lib/logrotate/status