logrotate, A Rotation That Really Happened
logrotate on EL 10: one drop-in for this host's own logs, checked by logrotate before it lands, with the timer the package ships enabled. The live test writes one log past the size limit and one well under it, runs the unit the timer runs rather than forcing it, and asserts the first rotated and was truncated while the second was left alone. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-26 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-logrotate-policy?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [logrotate, A Rotation That Really Happened](https://www.iac-bazaar.com/catalog/ansible-logrotate-policy?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# logrotate, A Rotation That Really Happened: https://www.iac-bazaar.com/catalog/ansible-logrotate-policy (download from your IaC Bazaar account)
```Preview:
Documentation
logrotate-policy
A rotation policy, and a rotation that really happened. The role writes one
drop-in under /etc/logrotate.d (checked by logrotate itself before it lands)
and makes sure the timer the package ships is enabled and running. The live test
writes a log past the size limit and a second one well under it, runs the unit
the timer runs, and asserts the first rotated and the second did not.
No download, and no version to pin. EL 10 packages logrotate and ships both the timer and the oneshot service, so the role installs it by name and enables what is already there. What the role owns is the policy: what rotates, how often, how many are kept, and whether the writer is signalled or the file is copied and truncated.
The distribution's own rules are left alone. Everything this role writes is
in one file, so dnf keeps owning the rotation of the logs it installed and
this role owns the rotation of yours.
The live test does not use logrotate -f. Forcing a rotation proves only
that logrotate can rename a file. Running it the way the timer does leaves the
maxsize condition to decide, and the quiet log that must NOT rotate is the
half of the test that makes the first half mean something.
logrotate.service carries ConditionACPower=true. On a laptop running on
battery the timer fires and the service does not run, and nothing reports an
error. That is the distribution's choice and this role keeps it, but it is worth
knowing before wondering why a developer machine's logs never rotate.
Two runs on one day produce one rotation, because dateext names the
rotated file after the day. A test that expects a second rotation from a second
run is testing nothing.
Enabling the timer runs the unit immediately. logrotate.timer is
Persistent=true, so systemd treats a missed daily run as due and starts it the
moment the timer is enabled. That is correct behaviour and it is also a trap for
anything that then asks the unit to run: systemctl start joins the run already
in flight, which read its file list before your fixture existed, and reports
success having rotated nothing. The live test waits for that run to finish
before it creates anything.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-victoria-logs
VictoriaLogs from the upstream release as a hardened service on loopback. Its JSON-lines endpoint answers 200 and stores nothing when the content type is wrong, so the README names the one it needs. The live test ingests two lines, gets the right one back from LogsQL, and sees an unwritten stream come back empty and bad LogsQL refused. Original role, live-tested on Rocky Linux 10.
ansible-alertmanager
Prometheus Alertmanager from the upstream release (sha256-verified) as a hardened system service on loopback, its cluster gossip listener switched off and its configuration checked by amtool before it lands. The live test posts an alert through the API and reads it back active, held by the default receiver, and expects no 9094 listener at all. Original role, live-tested on Rocky Linux 10.
ansible-alloy
Grafana Alloy from the upstream release (sha256-verified) as a hardened system service on loopback with --disable-reporting, a self-scrape pipeline that proves the collector runs, and its configuration checked by alloy validate before it lands. The live test reads Alloy's own metrics and asks the component API for the scrape component's health. Original role, live-tested on Rocky Linux 10.
ansible-blackbox-exporter
Prometheus Blackbox exporter from the upstream release (sha256-verified) as a hardened system service on loopback with HTTP and TCP modules, checked by --config.check before the file lands. The live test has it probe itself over HTTP and TCP (probe_success 1) and a port with nothing behind it (probe_success 0): it measures, not only answers. Original role, live-tested on Rocky Linux 10.
ansible-cockpit
Cockpit from BaseOS bound to loopback, with logins limited to an admin group through PAM and root refused outright. The live test sees an administrator log in while an ordinary account, a wrong password and root, placed in the admin group to isolate its own rule, are refused, and reads the login banner. Original role, live-tested on Rocky Linux 10.
ansible-fluent-bit
fluent-bit from EPEL, following a log-file glob it re-reads every few seconds and shipping over the Forward protocol, with retries unlimited instead of the default single retry. Its config is checked with --dry-run before it lands. The live test writes a line to a new file and watches it arrive at an aggregator it started. Original role, live-tested on Rocky Linux 10.