3 posts tagged with "disks"

Log management is a crucial part of any server administrator's job. Logs that are not rotated can quickly occupy all available disk space, slow down the server, and cause unpredictable errors. In this article, we’ll explain how to configure and use logrotate for automatic log cleanup and rotation on a server. 

What is logrotate and why is it important to use?​

Logrotate is a tool designed for automatic log management. It helps to:

• Clear old logs — automatically deletes or archives old log files.
• Save disk space — compresses and removes unnecessary logs.

Log rotation prevents logs from accumulating and causing disk overflow, which could result in crashes and data loss. Logrotate automatically archives old logs and makes room for new data.

How does logrotate work?​

When logrotate is active, it automatically performs the following steps:

1. Log rotation — old logs are renamed and stored, while new files are created in their place.
2. Compression — old logs can be compressed into .gz format to save space.
3. Deletion — outdated logs can be deleted if they are no longer needed.

Example: A log file named access.log can be transformed into access.log.1, then compressed into access.log.1.gz, and eventually deleted after a specified retention period.

How to configure logrotate​

1. Installing logrotate​

On most Linux systems, logrotate is pre-installed. To check if logrotate is installed, run the command:

sudo logrotate --version

 If logrotate is not installed, it can be installed via a package manager. 

• For Debian/Ubuntu:

sudo apt update && sudo apt install logrotate

• For CentOS/RockyLinux/AlmaLinux:

sudo yum install logrotate

2. Configuring logrotate​

Logrotate configuration is usually stored in /etc/logrotate.conf. This file contains general parameters for all logs on the server. To configure the rotation of individual logs, you can create separate configuration files for different services in the /etc/logrotate.d/ directory.

Example of a standard Nginx configuration:

/var/log/nginx/*.log {
	daily          # Logs are rotated daily
	missingok      # Do not display an error if the log is missing
	rotate 7       # Keep 7 archived files
	compress       # Compress old logs
	delaycompress  # Delay compression until the next rotation
	notifempty     # Do not rotate empty files
	create 0640 www-data adm  # Create new logs with specific permissions
}

3. Key configuration parameters​

• daily/weekly/monthly — defines how often the log file will be rotated (daily, weekly, or monthly).
• rotate [N] — specifies the number of archived logs to retain.
• compress — enables log file compression (typically into .gz).
• missingok — prevents errors if a log file is missing.
• notifempty — skips rotation for empty files.
• create — creates new logs with specified permissions.

4. Running logrotate​

Logrotate usually runs automatically via cron. However, you can run it manually if you need to check the configuration or perform a rotation immediately:

sudo logrotate -f /etc/logrotate.conf

5. Verifying logrotate's operation​

To ensure that logrotate is working correctly, you can check the latest entries in its service log:

sudo journalctl -u logrotate -n 10

Logs are files that store information about server events: application and operating system activity, various errors, user requests to websites, and more. Over time, logs can take up a significant amount of disk space, especially under heavy load or if there are software errors.

One critical aspect of log files is that, in most cases, deleting them can cause issues for the program generating them — whether it’s a web server or even the operating system itself.

Additionally, logs often contain valuable diagnostic information that can help identify software issues on your server and prevent larger problems. Therefore, it’s important to handle them properly and carefully.

How to identify logs that can be cleaned​

Use ncdu to locate large logs on the server. If a log file is unusually large, check its latest entries:

sudo tail /path/to/log

If there are no anomalies, check the beginning of the file to determine whether the log grew large simply due to age (pay attention to the date of the earliest entries):

sudo head /path/to/log

After this, you can proceed with cleaning the file.

How to safely clean logs​

The truncate command clears the contents of a file without deleting it:

sudo truncate -s 0 /var/log/nginx/error.log

Separately note the files that are logs, despite the lack of *.log extension:

• /var/log/btmp
• /var/log/syslog
• /var/log/messeges
• /var/log/secure
• /var/log/maillog

These files can also be safely cleaned using the truncate command.

A special case is the log located in the /var/log/journal directory. You can find more details about working with it in separate article.   

How to prevent logs from growing too large​

While analyzing logs, you may notice some of them have names like:

• syslog.1
• yoursite.access.log.1

These appear when log rotation is applied, for example, using the logrotate program. Old files can be deleted or compressed during rotation, saving disk space.

You can read more about configuring this mechanism in a separate article.

Running out of space on your server? This may cause the site and database to malfunction. To free up space, you need to identify the files taking up the most room and delete them. In this article, we’ll explain how to easily accomplish this using the ncdu utility and how to safely clean up logs.

Step 1: Installing and running ncdu​

ncdu  is a handy tool for disk space analysis. It displays all folders and files sorted by size in an easy-to-use text interface.

To use this program, you’ll need to connect to your server via SSH.  

Installation

• Debian/Ubuntu:

sudo apt update && sudo apt install ncdu

• CentOS/AlmaLinux/Rocky Linux:

sudo yum install ncdu

Running disk analysis

• To scan the root directory /, execute:

sudo ncdu -x /

The -x option in ncdu restricts the scan to a single file system, excluding mounted virtual directories (e.g., /proc, /dev, /sys) and any other volumes mounted via separate mount points (e.g., network or external drives).

• To analyze a specific directory:

sudo ncdu /path/to/directory

For example, to scan only the logs directory, run:

sudo ncdu /var/log

Step 2: Analyzing and deleting unnecessary files​

After running ncdu, you will see a list of files and folders sorted by size. Navigation is simple:

• Up/Down arrow keys — move through the list.
• Enter — navigate into a directory.
• D — delete the selected file or folder.

It is safer to create a list of files and directories taking up significant space (highlight rows in ncdu and copy them to a notepad on your local PC), then review each individually and delete them using the command line.

To delete a file, run:

sudo rm -f /path/to/file

To delete a directory:

sudo rm -rf /path/to/directory

  Here's a list of the major directories that tend to take up a lot of space:

1. /var/www/ - directory with your sites

Often, the largest directories are upload and cache in the root directory of the website, containing user-uploaded files and the site cache, respectively. For example:

/var/www/user/data/www/yoursite.com/upload/

Files in these directories are relatively safe to delete. However, only you, as the administrator of your website, know which files in the upload directory are important and which are no longer needed. It is recommended to leave the directory itself intact to avoid errors. 

2. /var/lib/mysql/

This is the directory containing your website databases. 

If it is taking up an unusually large amount of space, contact your hosting provider for a deeper analysis of the issue. 

3. /var/log/

This directory stores logs generated by software running on your server. Logs have specific characteristics, and their cleanup is covered in a separate article.

Step 3: Finalizing and verifying​

After deleting unnecessary files, check how much space has been freed using the command:

df -h