The UI logs errors to /var/log/ipa_error.log. We need a logrotate configuration file and ipa_webgui needs to know to re-open the logs on SIGHUP.
This is already set up in ipa_webgui.cfg: args="('/var/log/ipa_error.log', 'w6', 1, 4)" The log is rotated weekly on Sunday and 4 backups are kept.