In Ubuntu Server and other Debian-based Linux distributions, the logrotate.timer is a critical recurring systemd timer unit responsible for executing the logrotate.service. This service triggers the system-wide rotation, compression, and purging of log files generated by the kernel, system daemons, and installed applications (typically configured in /etc/logrotate.conf). While log rotation is an absolute necessity for preventing log files from consuming all available disk space on standard monolithic servers, it introduces unnecessary disk I/O and CPU overhead in specific, highly specialized environments. On ephemeral cloud containers, stateless microservices, or read-only immutable root filesystems where logs are immediately streamed off-host to a centralized aggregator (like Splunk, ELK, or Datadog) via stdout/stderr or a remote syslog daemon, local log rotation is entirely redundant and wastes compute cycles.
This guide explains how to completely disable the logrotate timer in Ubuntu Server, enforcing an absolute block on local log compression and rotation for environments relying strictly on centralized, off-host logging.
Stop and Mask the logrotate Timer
Because logrotate is a core administrative utility, a simple systemctl disable is insufficient; the timer will almost certainly be silently re-enabled by package managers during routine system updates. To enforce a strict, immutable block, we must explicitly mask the unit.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Stop the timer to halt any currently scheduled execution:
sudo systemctl stop logrotate.timer - Stop the associated service unit that the timer invokes, aborting any active log compression tasks:
sudo systemctl stop logrotate.service - Mask both the timer and service units. This symlinks them to
/dev/null, creating a hard block against future activation by package triggers, cron jobs, or manual invocations:sudo systemctl mask logrotate.timer sudo systemctl mask logrotate.service
Verify the Service Lockdown
By masking the timer and its associated service, you guarantee that systemd will completely reject any attempt to invoke local log rotation, ensuring that disk I/O and CPU resources are dedicated solely to application workloads rather than redundant file compression.
To verify the lockdown is successful, attempt to start the timer manually:
sudo systemctl start logrotate.timerSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start logrotate.timer: Unit logrotate.timer is masked). Furthermore, running systemctl list-timers --all will confirm that the logrotate.timer is completely absent from the active timers list. The server’s background maintenance pipeline is now strictly optimized for a stateless, centralized logging architecture.