Log rotation in Nginx - Commands & Configuration

Introduction

Log rotation helps keep log files from growing too large and using too much disk space. It automatically renames old logs and creates new ones so your server runs smoothly without manual cleanup.

When your nginx access or error logs grow very large and slow down your server.

When you want to keep logs organized by date for easier troubleshooting.

When disk space is limited and you need to delete old logs automatically.

When you want to compress old logs to save storage.

When you want to keep a fixed number of old log files for audit purposes.

Config File - logrotate.conf

logrotate.conf

/var/log/nginx/*.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        systemctl reload nginx > /dev/null 2>&1 || true
    endscript
}

This configuration tells the logrotate tool to manage all nginx log files in /var/log/nginx/.

daily: rotate logs every day.

missingok: don't error if logs are missing.

rotate 7: keep 7 old logs before deleting.

compress: compress old logs to save space.

delaycompress: delay compression until the next rotation.

notifempty: skip rotation if log is empty.

create 0640 www-data adm: create new log files with permissions and ownership.

sharedscripts: run postrotate script only once.

postrotate: reload nginx to start writing to new logs.

Commands

This command runs logrotate in debug mode to check the configuration without making changes. It helps verify your log rotation setup.

Terminal

sudo logrotate -d /etc/logrotate.conf

Expected Output

/var/log/nginx/*.log: log does not need rotating.

→

-d - Debug mode: shows what would happen without changing files

This forces logrotate to rotate the logs immediately according to the configuration. Useful to test or apply rotation right away.

Terminal

sudo logrotate -f /etc/logrotate.conf

Expected Output

No output (command runs silently)

→

-f - Force rotation even if not needed

List the nginx log files to see rotated and compressed logs after rotation.

Terminal

ls -l /var/log/nginx/

Expected Output

total 24

-rw-r----- 1 www-data adm  1234 Apr 26 10:00 access.log

-rw-r----- 1 www-data adm  5678 Apr 25 10:00 access.log.1

-rw-r----- 1 www-data adm  3456 Apr 24 10:00 access.log.2.gz

-rw-r----- 1 www-data adm  7890 Apr 26 10:00 error.log

-rw-r----- 1 www-data adm  2345 Apr 25 10:00 error.log.1

-rw-r----- 1 www-data adm  1234 Apr 24 10:00 error.log.2.gz

Key Concept

If you remember nothing else from log rotation, remember: rotating and compressing logs regularly keeps your server fast and your disk clean.

Common Mistakes

Not reloading nginx after log rotation

Nginx keeps writing to old log files if not reloaded, so new logs won't be created.

Use a postrotate script to reload nginx after rotating logs.

Setting rotate count too low or too high

Too low deletes logs too soon; too high wastes disk space.

Choose a rotate count that balances disk space and log retention needs, like 7 days.

Not compressing old logs

Old logs take up unnecessary disk space if not compressed.

Enable compression with the compress and delaycompress options.

Summary

Create a logrotate configuration file to manage nginx logs automatically.

Use 'logrotate -d' to test the configuration without changes.

Use 'logrotate -f' to force immediate log rotation.

Reload nginx after rotation to start new log files.

Check rotated and compressed logs in the log directory.

Practice

1. What is the main purpose of log rotation in nginx?

easy

A. To delete all logs automatically every hour

B. To stop nginx from creating logs

C. To keep log files from growing too large and manage disk space

D. To combine all logs into one big file

Solution

1. Step 1: Understand log file growth

   Log files grow continuously as nginx runs, which can fill up disk space.

2. Step 2: Purpose of log rotation

   Log rotation splits logs into smaller files and removes or archives old ones to save space.

3. Final Answer:

   To keep log files from growing too large and manage disk space -> Option C

4. Quick Check:

   Log rotation = Manage log size and disk space [OK]

Hint: Log rotation prevents huge log files filling your disk [OK]

Common Mistakes:

• Thinking logs are deleted every hour automatically
• Believing log rotation stops logging
• Assuming logs are merged into one file

2. Which of the following is the correct directive to reload nginx after log rotation?

easy

A. systemctl restart nginx

B. nginx -s reload

C. service nginx stop

D. nginx --rotate-logs

Solution

1. Step 1: Identify nginx reload command

   The command nginx -s reload tells nginx to reload configuration and reopen log files without stopping the service.

2. Step 2: Compare other options

   systemctl restart nginx restarts nginx fully, which is heavier. service nginx stop stops nginx, and nginx --rotate-logs is not a valid command.

3. Final Answer:

   nginx -s reload -> Option B

4. Quick Check:

   Reload nginx logs = nginx -s reload [OK]

Hint: Use 'nginx -s reload' to reopen logs after rotation [OK]

Common Mistakes:

• Using full restart instead of reload
• Stopping nginx instead of reloading
• Using invalid nginx commands

3. Given this logrotate config snippet for nginx logs:

/var/log/nginx/*.log {
  daily
  missingok
  rotate 7
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
  sharedscripts
  postrotate
    nginx -s reload
  endscript
}

What happens when logrotate runs?

medium

A. Logs rotate daily, delete all old logs, and nginx stops

B. Logs rotate weekly, keep 7 uncompressed files, and nginx restarts

C. Logs never rotate because of syntax error

D. Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation

Solution

1. Step 1: Analyze rotation frequency and retention

   The daily directive means logs rotate every day. rotate 7 keeps 7 old log files.

2. Step 2: Check compression and reload

   compress compresses old logs, delaycompress delays compression by one cycle. postrotate runs nginx -s reload to reopen logs.

3. Final Answer:

   Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation -> Option D

4. Quick Check:

   Daily rotate + 7 files + reload nginx = C [OK]

Hint: Look for 'daily', 'rotate 7', and 'postrotate nginx -s reload' [OK]

Common Mistakes:

• Confusing daily with weekly rotation
• Ignoring compression directives
• Assuming nginx restarts instead of reloads

4. You configured logrotate for nginx but notice logs are not rotating. Which is the most likely cause?

medium

A. The log file path in logrotate config is incorrect

B. The compress directive is missing

C. The rotate number is set to 0

D. The postrotate script does not reload nginx

Solution

1. Step 1: Check log file path correctness

   If the log file path in the logrotate config does not match actual nginx log locations, rotation won't happen.

2. Step 2: Evaluate other options

   Not reloading nginx delays log reopening but rotation still occurs. rotate 0 disables rotation but is rare. Missing compress only affects compression, not rotation.

3. Final Answer:

   The log file path in logrotate config is incorrect -> Option A

4. Quick Check:

   Wrong log path = no rotation [OK]

Hint: Verify log file paths in config match actual nginx logs [OK]

Common Mistakes:

• Assuming missing reload stops rotation
• Thinking compression affects rotation
• Ignoring log file path accuracy

5. You want to rotate nginx logs only when they reach 100MB size, keep 5 backups, compress old logs, and reload nginx smoothly. Which logrotate config snippet achieves this?

hard

A. /var/log/nginx/*.log {
size 100M
rotate 5
compress
missingok
notifempty
sharedscripts
postrotate
nginx -s reload
endscript
}

B. /var/log/nginx/*.log {
daily
rotate 5
compress
postrotate
systemctl restart nginx
endscript
}

C. /var/log/nginx/*.log {
size 100M
rotate 10
delaycompress
postrotate
nginx -s reload
endscript
}

D. /var/log/nginx/*.log {
weekly
rotate 5
compress
postrotate
nginx -s reload
endscript
}

Solution

1. Step 1: Match size and rotate count requirements

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } uses size 100M to rotate at 100MB and rotate 5 to keep 5 backups, matching requirements.

2. Step 2: Check compression and reload commands

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } includes compress and postrotate nginx -s reload for smooth reload. Others use wrong rotate count, timing, or restart instead of reload.

3. Final Answer:

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } -> Option A

4. Quick Check:

   Size 100M + rotate 5 + compress + reload nginx = A [OK]

Hint: Look for 'size 100M', 'rotate 5', 'compress', and 'nginx -s reload' [OK]

Common Mistakes:

• Using daily or weekly instead of size-based rotation
• Restarting nginx instead of reloading
• Wrong rotate count or missing compress