2 posts tagged with "logs"

Log management is a crucial part of any server administrator's job. Logs that are not rotated can quickly occupy all available disk space, slow down the server, and cause unpredictable errors. In this article, we’ll explain how to configure and use logrotate for automatic log cleanup and rotation on a server. 

What is logrotate and why is it important to use?​

Logrotate is a tool designed for automatic log management. It helps to:

• Clear old logs — automatically deletes or archives old log files.
• Save disk space — compresses and removes unnecessary logs.

Log rotation prevents logs from accumulating and causing disk overflow, which could result in crashes and data loss. Logrotate automatically archives old logs and makes room for new data.

How does logrotate work?​

When logrotate is active, it automatically performs the following steps:

1. Log rotation — old logs are renamed and stored, while new files are created in their place.
2. Compression — old logs can be compressed into .gz format to save space.
3. Deletion — outdated logs can be deleted if they are no longer needed.

Example: A log file named access.log can be transformed into access.log.1, then compressed into access.log.1.gz, and eventually deleted after a specified retention period.

How to configure logrotate​

1. Installing logrotate​

On most Linux systems, logrotate is pre-installed. To check if logrotate is installed, run the command:

sudo logrotate --version

 If logrotate is not installed, it can be installed via a package manager. 

• For Debian/Ubuntu:

sudo apt update && sudo apt install logrotate

• For CentOS/RockyLinux/AlmaLinux:

sudo yum install logrotate

2. Configuring logrotate​

Logrotate configuration is usually stored in /etc/logrotate.conf. This file contains general parameters for all logs on the server. To configure the rotation of individual logs, you can create separate configuration files for different services in the /etc/logrotate.d/ directory.

Example of a standard Nginx configuration:

/var/log/nginx/*.log {
	daily          # Logs are rotated daily
	missingok      # Do not display an error if the log is missing
	rotate 7       # Keep 7 archived files
	compress       # Compress old logs
	delaycompress  # Delay compression until the next rotation
	notifempty     # Do not rotate empty files
	create 0640 www-data adm  # Create new logs with specific permissions
}

3. Key configuration parameters​

• daily/weekly/monthly — defines how often the log file will be rotated (daily, weekly, or monthly).
• rotate [N] — specifies the number of archived logs to retain.
• compress — enables log file compression (typically into .gz).
• missingok — prevents errors if a log file is missing.
• notifempty — skips rotation for empty files.
• create — creates new logs with specified permissions.

4. Running logrotate​

Logrotate usually runs automatically via cron. However, you can run it manually if you need to check the configuration or perform a rotation immediately:

sudo logrotate -f /etc/logrotate.conf

5. Verifying logrotate's operation​

To ensure that logrotate is working correctly, you can check the latest entries in its service log:

sudo journalctl -u logrotate -n 10

Logs are files that store information about server events: application and operating system activity, various errors, user requests to websites, and more. Over time, logs can take up a significant amount of disk space, especially under heavy load or if there are software errors.

One critical aspect of log files is that, in most cases, deleting them can cause issues for the program generating them — whether it’s a web server or even the operating system itself.

Additionally, logs often contain valuable diagnostic information that can help identify software issues on your server and prevent larger problems. Therefore, it’s important to handle them properly and carefully.

How to identify logs that can be cleaned​

Use ncdu to locate large logs on the server. If a log file is unusually large, check its latest entries:

sudo tail /path/to/log

If there are no anomalies, check the beginning of the file to determine whether the log grew large simply due to age (pay attention to the date of the earliest entries):

sudo head /path/to/log

After this, you can proceed with cleaning the file.

How to safely clean logs​

The truncate command clears the contents of a file without deleting it:

sudo truncate -s 0 /var/log/nginx/error.log

Separately note the files that are logs, despite the lack of *.log extension:

• /var/log/btmp
• /var/log/syslog
• /var/log/messeges
• /var/log/secure
• /var/log/maillog

These files can also be safely cleaned using the truncate command.

A special case is the log located in the /var/log/journal directory. You can find more details about working with it in separate article.   

How to prevent logs from growing too large​

While analyzing logs, you may notice some of them have names like:

• syslog.1
• yoursite.access.log.1

These appear when log rotation is applied, for example, using the logrotate program. Old files can be deleted or compressed during rotation, saving disk space.

You can read more about configuring this mechanism in a separate article.