Logrotate Syntax Error: 3 Fixes That Actually Work

1. Missing Closing Brace — The Usual Suspect

Every time I get a call about logrotate failing, the culprit is almost always a missing } brace. You'd think after 14 years I'd stop being surprised, but nope. People forget them all the time.

Here's the error you'll see in syslog or when running logrotate -d /etc/logrotate.conf:

error: /etc/logrotate.d/nginx:1: unexpected end of file

Line 1? That's a red flag. It means the config file ended before logrotate was done parsing it. The fix is simple: open the file and count your braces.

Example of a broken nginx config:

/var/log/nginx/*.log {
    daily
    rotate 7
    compress
    missingok
    notifempty
    postrotate
        invoke-rc.d nginx reload > /dev/null 2>&1 || true
    endscript

See that? No closing brace. The } after endscript is missing. Add it and you're done.

Quick fix:

echo "}" >> /etc/logrotate.d/nginx

Then test it:

logrotate -d /etc/logrotate.conf

No errors? You're golden. If it's still broken, move on to cause #2.

2. Bad File Path or Wildcard — Logrotate Can't Find the Logs

Another common one: the path in the config file doesn't match any actual log files. Logrotate doesn't throw a visible error for this in normal runs — it just silently skips it. But when you do a dry run with -d, you'll see something like:

error: /etc/logrotate.d/myapp:1: glob pattern '/var/log/myapp/*.log' doesn't match any files

This usually means one of three things:

• The directory doesn't exist. Maybe someone removed the log dir or renamed it.
• The wildcard pattern is wrong. If your files end in .txt and you're looking for *.log, nothing matches.
• The path has a typo. Missing a slash or a letter. I've seen /var/og instead of /var/log more than once.

Fix it: Check that the directory exists and the pattern matches.

ls -la /var/log/myapp/
# If the directory doesn't exist, create it:
mkdir -p /var/log/myapp/
# Or fix the path in the config file

Also, verify your log files actually use the extension you think. Some apps write to .log, others to .txt, some to no extension at all. Use ls to confirm.

3. Duplicate Entries — Logrotate Gets Confused

This one's sneaky. You have multiple config files in /etc/logrotate.d/ that reference the same log file path. Logrotate will process them in alphabetical order, and the second one overwrites the first. But if the syntax differs between the two, you'll get weird errors.

Typical sign: logrotate runs but some settings don't apply. Or you see a warning like:

warning: /etc/logrotate.d/syslog:1: duplicate log entry for /var/log/messages

How it happens: Maybe you installed a package that added its own config, and you also added a custom one. Or someone copied a config file and forgot to rename it. I've seen /etc/logrotate.d/nginx and /etc/logrotate.d/nginx-custom both pointing to /var/log/nginx/*.log. That's a mess.

Fix it: Find the duplicates and consolidate them.

grep -r "/var/log/messages" /etc/logrotate.d/

That shows you every file referencing that path. Remove or edit the extra ones so only one config covers each log file. Merge the settings you need into a single file.

Pro tip: name your config files with numbers if you want a specific order. Like 10-nginx and 20-mysql. But keep them unique.

Quick-Reference Summary Table

Save yourself the headache. Always run logrotate -d /etc/logrotate.conf after editing any config file. It catches 90% of these errors before they hit production. Don't skip it.