Description
logrotate renames, compresses and removes the text log files under /var/log/ following
/etc/logrotate.conf and the files that packages drop in /etc/logrotate.d/. Ubuntu installs it
by default and starts it every day with logrotate.timer.
This control requires the logrotate package and its timer to be enabled.
The systemd journal rotates itself (CB-UBU-AUDIT-001) and auditd rotates its own logs (CB-UBU-AUDIT-013); logrotate handles the remaining text files.
Rationale
Logs that are never rotated end up filling the file system, which stops the services that need to write, or are deleted by hand in a hurry. Rotation keeps a predictable history.
Impact
Old rotated files are deleted after the number of rotations set in each logrotate file (4 weeks
by default in /etc/logrotate.conf). Keep a remote copy when a longer history is required.
Setting
| Location | logrotate package, logrotate.timer |
| Default | Not installed on cloud images |
| Recommended | Installed, timer enabled |
Audit
- Run
dpkg-query -W -f='${Status}\n' logrotate. It must end withinstalled. - Run
systemctl is-enabled logrotate.timer. It must printenabled. - Review
/etc/logrotate.confand/etc/logrotate.d/against the site retention policy.
Automated: every check must pass. Scanners report each check by its id.
package
logrotate is installed.
name: logrotate
state: installed
timer
logrotate.timer is enabled.
unit: logrotate.timer
state: enabled
Remediation
Run apt-get install logrotate, then systemctl enable --now logrotate.timer.
| Restart | none |
| Disruption | none |
Rollback
Run apt-get purge logrotate.
package
Generated from check package: the engine writes the fix for every output, it sets the expected value and the check runs again after.
timer
Generated from check timer: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- logrotate(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71) ANSSI, guide, accessed 2026-10-19
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R71 | partial | |
| NIST SP 800-53 Rev. 55.1.1 | AU-4 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| Common Weakness Enumeration | CWE-400 |
Related controls
- related
CB-UBU-AUDIT-001Keep the systemd journal running, persistent, compressed and bounded in size
People and lifecycle
| Authors |
|
| Verified | 2026-10-19 by Sn0wAlice on 20.04, Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic. Passes on stock image (logrotate installed, logrotate.timer enabled). |
| Verified | 2026-10-19 by Sn0wAlice on 22.04, Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic. Passes on stock image (logrotate installed, logrotate.timer enabled). |
| Verified | 2026-10-19 by Sn0wAlice on 24.04, Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic. Passes on stock image (logrotate installed, logrotate.timer enabled). |
| Verified | 2026-10-19 by Sn0wAlice on 26.04, Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic. Passes on stock image (logrotate installed, logrotate.timer enabled). |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-19, 2026-10-19 |
| Translations | fr |
