How to Stop Ubuntu from Automatically Clearing the System Log (logrotate)

Linux is famous for keeping incredibly detailed logs of everything that happens on the system, from SSH login attempts and kernel panics to standard cron job executions. These logs are stored in the /var/log/ directory. To prevent these plaintext files from growing indefinitely and eventually filling up your entire hard drive, Ubuntu uses a background utility called logrotate.

By default, logrotate runs daily. It takes your active log files (like syslog or auth.log), compresses them into a gzip archive, starts a fresh empty log file, and completely deletes the oldest archives (usually keeping only 4 to 7 days of history).

If you are a forensic security analyst trying to investigate a server breach that occurred three weeks ago, this automatic deletion is a disaster. The evidence has already been permanently wiped by the operating system.

How to Stop Logrotate from Deleting Old Logs

To retain your system logs indefinitely, you must edit the global logrotate configuration file to tell the utility to never delete the old, compressed archives.

1. Open your terminal application (Ctrl+Alt+T).
2. Open the primary logrotate configuration file using a text editor with root privileges:

sudo nano /etc/logrotate.conf

3. Look for a line near the top of the file that dictates the rotation cycle. By default, it might say something like:

rotate 4 (This tells the system to only keep 4 old log files before deleting the oldest one).

4. Change this number to something massive, effectively telling the system to keep a virtually infinite number of old archives. For example:

rotate 9999

5. Save the file (Ctrl+O, Enter) and exit nano (Ctrl+X).

Warning: Monitor Your Disk Space

By changing this setting, Ubuntu will still compress your old logs, but it will never delete them. Over the course of several years on a highly active web server, this directory will consume gigabytes of storage space. You must remember to manually move these archives to an external cold storage drive periodically to prevent your primary system partition from running out of inodes and crashing.