Lesson 2.49: logrotate: keeping logs from filling the disk
Text logs grow forever unless something rotates them: renames the current file, starts a new one, compresses old copies and deletes the oldest. On most Linux systems that's logrotate, run daily by a systemd timer, with one configuration file per application in /etc/logrotate.d. A full disk is both an outage and a security problem, because a server that can't write logs stops recording what happens. In the lab web02's disk is almost full; you find the 2.4 GB log, discover why it never rotated, fix the rule, test it with a dry run and rotate it.
15 min
You will learn to
- Explain log rotation
- Read a logrotate configuration
- Use logrotate -d to see what would happen
- Find why a log isn't rotated
- Rotate and confirm the space is freed
Key terms
- Rotation
- Renaming the current log (api.log → api.log.1), starting a fresh one, and removing the oldest copies.
- rotate N
- How many old copies to keep.
- compress / delaycompress
- Gzip old copies; delaycompress waits one cycle so the newest copy stays readable.
- missingok
- Don't report an error if the log is missing.
- postrotate
- Commands run after rotation, typically telling the service to reopen its log file.
← Getting help on the command line · All lessons · Memory limits and the OOM killer →