Rotate log files with logrotate

Description

logrotate renames, compresses and removes the text log files under /var/log/ following /etc/logrotate.conf and the files that packages drop in /etc/logrotate.d/. On Debian it is started every day by logrotate.timer. The Debian 12 and 13 cloud images do not install it.

This control requires the logrotate package and its timer to be enabled.

The systemd journal rotates itself (CB-DEB-AUDIT-001) and auditd rotates its own logs (CB-DEB-AUDIT-013); logrotate handles the remaining text files.

Rationale

Logs that are never rotated end up filling the file system, which stops the services that need to write, or are deleted by hand in a hurry. Rotation keeps a predictable history.

Impact

Old rotated files are deleted after the number of rotations set in each logrotate file (4 weeks by default on Debian). Keep a remote copy when a longer history is required.

Setting

Audit

1. Run dpkg-query -W -f='${Status}\n' logrotate. It must end with installed.
2. Run systemctl is-enabled logrotate.timer. It must print enabled.
3. Review /etc/logrotate.conf and /etc/logrotate.d/ against the site retention policy.

Automated: every check must pass. Scanners report each check by its id.

package

logrotate is installed.

name: logrotate
state: installed

timer

logrotate.timer is enabled.

unit: logrotate.timer
state: enabled

Remediation

Run apt-get install logrotate, then systemctl enable --now logrotate.timer.

Rollback

Run apt-get purge logrotate.

package

Generated from check package: the engine writes the fix for every output, it sets the expected value and the check runs again after.

timer

Generated from check timer: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• logrotate(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-001 Keep the systemd journal running, persistent, compressed and bounded in size

People and lifecycle