logrotate does exactly what it is told, and refuses what it cannot trust — cheat sheet

# what would happen, and why — changes nothing
sudo logrotate -d /etc/logrotate.conf
sudo logrotate -d /etc/logrotate.d/shop          # one policy (defaults from logrotate.conf not applied)
# for real
sudo logrotate /etc/logrotate.conf               # what the nightly timer runs
sudo logrotate -f /etc/logrotate.d/shop          # force, ignoring the size/time rule
sudo logrotate -v -f -s /tmp/state /tmp/test.conf # test a copy with its own state file
grep shop /var/lib/logrotate/status              # when it last rotated
systemctl list-timers logrotate.timer            # systemd: who starts it

# a policy
/var/log/shop/*.log {
    su shop shop            # rotate as the directory's owner when it is not root's
    size 50M                # or: daily / weekly … ; maxsize 50M rotates early; minsize waits
    rotate 7                # keep seven; 0 keeps none
    compress                # gzip old logs
    delaycompress           # …but not the newest, for one cycle
    missingok               # no error if the log is absent
    notifempty              # do not rotate empty logs
    create 0640 shop shop   # new log's mode and owner   (alternative: copytruncate)
    sharedscripts           # run postrotate once for the whole glob
    postrotate
        systemctl reload shop >/dev/null 2>&1 || true
    endscript
}

# the refusals
# "Ignoring X because it is writable by group or others"  → chmod 0644, owned by root
# "parent directory has insecure permissions … Set \"su\""  → su <owner> <group>, not chown root

# sizes
ls -l app.log                      # apparent size: what logrotate compares
du -h app.log ; du -h --apparent-size app.log