Why am I getting permission denied on renaming my log file when running logrotate? The owner of my log file shown below is rajohns which is the same user that is logged in running the logrotate command shown below.

$ cat /etc/logrotate.d/judgecard-api-0.0.1

/var/log/judgecard-api-0.0.1.log {
    su rajohns rajohns
    rotate 4
    create 0777 rajohns rajohns
        systemctl restart judgecard-api-0.0.1.service > /dev/null

$ ls -l /var/log/judgecard-api-0.0.1.log

-rwxrwxrwx 1 rajohns rajohns 10578 Feb 12 23:01 /var/log/judgecard-api-0.0.1.log

$ sudo logrotate -vf -s ~/logrotate_test_status_file judgecard-api-0.0.1

reading config file judgecard-api-0.0.1

Handling 1 logs

rotating pattern: /var/log/judgecard-api-0.0.1.log  forced from command line (4 rotations)
empty log files are not rotated, old logs are removed
switching euid to 1000 and egid to 1000
considering log /var/log/judgecard-api-0.0.1.log
  log needs rotating
rotating log /var/log/judgecard-api-0.0.1.log, log->rotateCount is 4
dateext suffix '-20180212'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/judgecard-api-0.0.1.log.4 to /var/log/judgecard-api-0.0.1.log.5 (rotatecount 4, logstart 1, i 4), 
old log /var/log/judgecard-api-0.0.1.log.4 does not exist
renaming /var/log/judgecard-api-0.0.1.log.3 to /var/log/judgecard-api-0.0.1.log.4 (rotatecount 4, logstart 1, i 3), 
old log /var/log/judgecard-api-0.0.1.log.3 does not exist
renaming /var/log/judgecard-api-0.0.1.log.2 to /var/log/judgecard-api-0.0.1.log.3 (rotatecount 4, logstart 1, i 2), 
old log /var/log/judgecard-api-0.0.1.log.2 does not exist
renaming /var/log/judgecard-api-0.0.1.log.1 to /var/log/judgecard-api-0.0.1.log.2 (rotatecount 4, logstart 1, i 1), 
old log /var/log/judgecard-api-0.0.1.log.1 does not exist
renaming /var/log/judgecard-api-0.0.1.log.0 to /var/log/judgecard-api-0.0.1.log.1 (rotatecount 4, logstart 1, i 0), 
old log /var/log/judgecard-api-0.0.1.log.0 does not exist
log /var/log/judgecard-api-0.0.1.log.5 doesn't exist -- won't try to dispose of it
renaming /var/log/judgecard-api-0.0.1.log to /var/log/judgecard-api-0.0.1.log.1
error: failed to rename /var/log/judgecard-api-0.0.1.log to /var/log/judgecard-api-0.0.1.log.1: Permission denied
switching euid to 0 and egid to 0
  • 1
    Do you have write permission in /var/log with user rajohns? Feb 13, 2018 at 6:27

1 Answer 1


Obviously the /var/log rotate fails, as the directory normally belongs to root:adm.

You can have a look at Apache and others to see how they do it.

The usual way of doing it is creating a subdirectory under /var/log and making another user the owner of it:

 sudo mkdir /var/log/judgecards
 chown rajohns /var/log/judgecards

Then move the old logs and create new logs of your app here.

  • This worked. I'm still a little confused though. I was able to manually create/rename files in /var/log with rajohns, so why couldn't logrotate do it when run from rajohns?
    – Adam Johns
    Feb 14, 2018 at 15:51
  • root can create a file and give it to rajohns under /var/log ; then rajohns will be able to use it. However, unless you messed around with /var/log default permissions, rajohns cannot create new files there. Feb 14, 2018 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .