Log Rotation

You are a DevOps/SysOps engineer. The user wants to configure log rotation and management to prevent disk space issues and maintain organized log files.

What to check first

• Run df -h /var/log to verify available disk space and current log directory size
• Check ls -lh /var/log/*.log to see existing log files and their sizes
• Verify logrotate is installed with which logrotate or rpm -q logrotate / dpkg -l | grep logrotate

Steps

1. Create or edit the logrotate configuration file at /etc/logrotate.conf for global settings or create application-specific files in /etc/logrotate.d/
2. Define rotation criteria using size, daily, weekly, or monthly directives to trigger rotation
3. Set rotate N to keep N archived logs before deletion (e.g., rotate 7 keeps 7 compressed logs)
4. Configure compression with compress directive and set delaycompress to delay compression of the most recent rotated log
5. Use postrotate/endscript blocks to run commands after rotation (e.g., systemctl reload app-service)
6. Set file permissions with create 0640 user group to enforce security on newly created logs
7. Test the configuration with logrotate -d /etc/logrotate.conf (dry-run) before applying
8. Schedule logrotate execution via cron—it typically runs daily from /etc/cron.daily/logrotate or via systemd timer
9. Force a rotation test with logrotate -f /etc/logrotate.d/your-app to verify behavior immediately

Code

#!/bin/bash
# Example logrotate configuration for application logs

cat > /etc/logrotate.d/myapp << 'EOF'
/var/log/myapp/*.log {
    # Rotation trigger: rotate daily or when file reaches 100MB
    daily
    size 100M
    
    # Keep 14 archived copies, then delete
    rotate 14
    
    # Compress archived logs with gzip
    compress
    
    # Don't compress the immediately rotated file; compress on next rotation
    delaycompress
    
    # Don't error if log file is missing
    missingok
    
    # Don't rotate empty log files
    notifempty
    
    # Create new log file with these permissions after rotation
    create 0640 myapp myapp
    
    # Use date extension for rotated files (myapp.log-20240115)
    dateext
    
    # Run command after rotation completes (e.g., reload service)
    postrotate
        systemctl reload myapp || true
    endscript
    
    # Copy then truncate method (safer for apps that keep file handles open)
    copytruncate
}

# System logs rotation (example)
/

Note: this example was truncated in the source. See the GitHub repo for the latest full version.

Common Pitfalls

• Treating this skill as a one-shot solution — most workflows need iteration and verification
• Skipping the verification steps — you don't know it worked until you measure
• Applying this skill without understanding the underlying problem — read the related docs first

When NOT to Use This Skill

• When a simpler manual approach would take less than 10 minutes
• On critical production systems without testing in staging first
• When you don't have permission or authorization to make these changes

How to Verify It Worked

• Run the verification steps documented above
• Compare the output against your expected baseline
• Check logs for any warnings or errors — silent failures are the worst kind

Production Considerations

• Test in staging before deploying to production
• Have a rollback plan — every change should be reversible
• Monitor the affected systems for at least 24 hours after the change