How to Stop Ubuntu from Automatically Purging Old Log Files (Logrotate)

Ubuntu Linux is designed to run indefinitely as a stable server operating system. However, applications running on a server constantly generate text-based log files (e.g., Apache access logs, system auth logs, and kernel messages). If left unchecked, these text files could eventually grow to terabytes in size and crash the system. To prevent this, Ubuntu uses a background utility called logrotate that automatically compresses old logs and permanently deletes (purges) them after a specific period (usually 4 to 12 weeks).

While this is essential for saving disk space on a standard web server, it is a massive problem if you are running a high-security audit server or a compliance machine. If an HR department or a legal team requires you to keep an unbroken, five-year historical record of every single user login attempt (found in /var/log/auth.log), Ubuntu’s automated logrotate script will silently destroy your critical evidence every single month.

You can explicitly reconfigure the logrotate utility to completely disable the deletion phase, forcing it to compress and archive the log files indefinitely rather than purging them.

How to Stop Logrotate from Deleting Old Logs

You must edit the global logrotate.conf file or the specific application’s configuration file.

1. Open your terminal application (Ctrl+Alt+T) or SSH into your server.
2. Open the global logrotate configuration file in a text editor with root privileges:
   sudo nano /etc/logrotate.conf
3. Look for a line that specifies the rotation count, usually written as rotate 4 (meaning it keeps 4 weeks of logs before deleting the oldest).
4. To keep the logs forever, change this number to an impossibly high value, such as:
   rotate 9999
5. Alternatively, if you only want to stop deletion for a specific log (like the system logs), edit the rsyslog configuration:
   sudo nano /etc/logrotate.d/rsyslog
   And change the rotate value in that specific block to 9999.
6. Press Ctrl+O then Enter to save the file, and Ctrl+X to exit nano.

Warning: By disabling the deletion phase, your /var/log partition will eventually fill up entirely. You must manually move these compressed archives to a dedicated storage server or an Amazon S3 bucket to prevent system failure.

Ubuntu’s logrotate utility will continue to compress your logs weekly to keep them manageable, but it will never again issue the command to permanently delete the oldest archives.