Replacing logrotate: Best Log Rotation Alternatives for Linux

Introduction / Why You Need This

The standard logrotate has handled basic administration tasks for decades, but modern applications generate gigabytes of structured data daily. Manual configurations via cron, lack of built-in validation, and file locking issues under high load are pushing professionals to seek more reliable solutions. Switching to modern alternatives provides automatic config validation before deployment, on-the-fly compression without performance degradation, and the ability to instantly ship archives to cloud storage or monitoring systems. You'll get a stable disk space cleanup process and protection against partition overflow.

Requirements / Preparation

Before you begin, ensure you have root privileges or sudo access. The server must have systemd configured, as most modern tools rely on it for lifecycle management. Prepare a backup of the /var/log directory and your current rotation configs in advance.

⚠️ Important: Test the migration in a staging environment or during off-peak nighttime hours to avoid accidental loss of critical logs or application write locks.

Step 1: Audit Current Rotation

Assess the current I/O subsystem load and the volume of generated data. Run the following commands:

du -sh /var/log/*
ls -la /etc/logrotate.d/

If log volume exceeds 5 GB per day or you need to ship data to Grafana/Loki/ELK, choose Vector (written in Rust, high performance). For simple local rotation with minimal memory overhead, logrotate-ng or swatch will suffice. In this guide, we will configure vector as the most versatile and high-performance solution.

Step 2: Installation and Basic Configuration

Add the official repository and install the package. Example for Debian/Ubuntu:

curl -1sLf 'https://repositories.timber.io/public/vector/install.bash' | sudo bash
sudo apt update && sudo apt install vector

For RHEL/CentOS 9 / AlmaLinux:

curl -1sLf 'https://repositories.timber.io/public/vector/install.bash' | sudo bash
sudo dnf install vector

After installation, enable the service but do not start it immediately: sudo systemctl enable vector. This guarantees an automatic start after a reboot but prevents it from intercepting logs before configuration is complete.

Step 3: Configuring Rotation Rules

Create or edit the configuration file /etc/vector/vector.toml. We will configure log collection, compression, and saving to an archive folder with a policy to delete files older than 30 days.

[sources.syslog_reader]
type = "file"
include = ["/var/log/syslog", "/var/log/*.log"]
read_from = "beginning"

[transforms.log_parser]
type = "remap"
inputs = ["syslog_reader"]
source = """
. = parse_syslog!(.message)
"""

[sinks.local_archive]
type = "file"
inputs = ["log_parser"]
encoding.codec = "json"
path = "/var/log/archived/%Y-%m-%d-%H.log.gz"
compression = "gzip"
rotation = { max_bytes = 1000000000 }  # Rotate when reaching 1 GB

The configuration uses the built-in rotation.max_bytes rotation mechanism and automatically archives files on a schedule. To validate the syntax, run vector validate /etc/vector/vector.toml. If the output contains [OK], proceed to the next step.

Step 4: Migration and Disabling logrotate

After successful validation, start the service: sudo systemctl start vector. Check the status using journalctl -u vector -f. If there are no errors in the logs and files appear in /var/log/archived/, you can safely disable the standard tool:

sudo systemctl stop logrotate.timer
sudo systemctl mask logrotate.timer

Remove the old configuration files from /etc/logrotate.d/ and /etc/logrotate.conf, after ensuring that all services have switched to the new handler.

💡 Tip: Instead of completely deleting the logrotate configs, temporarily rename the /etc/logrotate.d directory to /etc/logrotate.d.bak. If a quick rollback is needed, mv commands will restore functionality in seconds.

Verifying the Results

Generate a test load and verify that rotation triggers automatically. Run the following loop:

for i in {1..5000}; do logger "Тестовая запись ротации $i"; done
ls -lh /var/log/archived/

You should see compressed files with correct sizes and timestamps. Check disk usage: df -h /var/log. The volume should remain stable, and old archives should be deleted according to the retention policy settings. Ensure that applications continue writing events without No space left on device errors.

Common Issues

• Permission denied error: The new service runs under the system vector user, which sometimes lacks access to restricted system logs. Add the user to the adm or systemd-journal group: sudo usermod -aG adm vector and restart the service via sudo systemctl restart vector.
• Duplicate entries: If logrotate and the new tool run simultaneously, logs may duplicate and consume double the space. Ensure that logrotate.timer is completely stopped and masked, and that applications are writing to journald or directly to the new service's handler.
• High CPU usage during compression: If the server is under load, change the compression algorithm to zstd in the vector.toml or fluent-bit.conf configuration. It provides a better balance of speed and compression ratio, reducing I/O wait and freeing up CPU time for workloads.