The Disappearing Data
In Ubuntu (and Linux in general), system and application logs are crucial for troubleshooting. Over time, these log files in the `/var/log/` directory can grow massive, consuming significant disk space. To prevent the hard drive from filling up with text files, Ubuntu uses a background utility called `logrotate`. This utility automatically runs on a schedule (usually daily via cron) to compress old logs, archive them, and eventually delete (or “truncate”) the oldest ones. While essential for server maintenance, if you are actively trying to diagnose a long-running issue, you might find that `logrotate` has automatically truncated the exact log file you needed right before you could analyze it.
Configuring the Logrotate Daemon
To preserve your historical data and stop Ubuntu from automatically truncating specific log files, you must modify the configuration files used by the `logrotate` utility.
Open your terminal (Ctrl+Alt+T). The main configuration file is `/etc/logrotate.conf`, but specific service rules are stored in the `/etc/logrotate.d/` directory. To stop a specific log from being rotated, you need to edit its corresponding file. For example, if you want to stop the system authorization logs from rotating, you would edit the rsyslog config: sudo nano /etc/logrotate.d/rsyslog.
Inside the configuration block for the specific log file (e.g., `/var/log/auth.log { … }`), look for directives like `rotate 4` (which means keep 4 weeks of logs) or `weekly`. To completely stop rotation for that specific file, you can comment out its entire block by placing a `#` symbol at the beginning of each line. Alternatively, to keep the logs much longer instead of disabling rotation entirely, change the `rotate` number to a very high value (e.g., `rotate 365`) and ensure the size directive (if present) is large enough. Save the file (Ctrl+O, Enter) and exit (Ctrl+X). The changes will take effect on the next scheduled cron run.