Log rotation in Nginx - Mini Project: Build & Apply

Log Rotation Setup for Nginx

📖 Scenario: You manage a web server using Nginx. The server creates log files that grow over time. To keep your server clean and avoid running out of disk space, you need to set up log rotation. Log rotation means saving old logs and starting fresh ones regularly.

🎯 Goal: Set up a basic log rotation configuration for Nginx logs using a configuration file. You will create the initial log rotation config, add rotation settings, apply the rotation command, and finally check the rotated logs.

📋 What You'll Learn

Create a log rotation configuration file for Nginx logs

Set the rotation frequency to daily

Keep 7 rotated log files

Compress old log files

Reload Nginx logs after rotation

💡 Why This Matters

🌍 Real World

Web servers generate large log files that can fill up disk space. Log rotation helps keep logs manageable and the server running smoothly.

💼 Career

System administrators and DevOps engineers regularly configure log rotation to maintain server health and troubleshoot issues efficiently.

1

Create the initial log rotation config file

Create a file called /etc/logrotate.d/nginx with the content starting with /var/log/nginx/*.log { on the first line and ending with } on the last line.

Nginx

# Create the file /etc/logrotate.d/nginx with opening and closing braces
# Your code here

Hint

Use a text editor or echo command to create the file with the required lines.

2

Add rotation frequency and retention settings

Inside the /etc/logrotate.d/nginx file, add the lines daily, rotate 7, and compress between the braces to set daily rotation, keep 7 files, and compress old logs.

Nginx

/var/log/nginx/*.log {
    # Add daily rotation
    # Keep 7 rotated files
    # Compress old logs
    # Your code here
}

Hint

Each setting goes on its own line inside the braces.

3

Add command to reload Nginx after rotation

Add the line postrotate followed by systemctl reload nginx and endscript inside the braces to reload Nginx after logs rotate.

Nginx

/var/log/nginx/*.log {
    daily
    rotate 7
    compress
    # Add postrotate block to reload nginx
    # Your code here
}

Hint

Indent the commands inside postrotate and endscript for clarity.

4

Test the log rotation and check rotated logs

Run the command logrotate -f /etc/logrotate.d/nginx to force log rotation. Then run ls /var/log/nginx/ to list the log files and verify rotated logs with extensions like .1.gz exist.

Nginx

# Run logrotate force command and list nginx logs
# Your code here

Hint

Use logrotate -f to force rotation and ls to check files.

Practice

1. What is the main purpose of log rotation in nginx?

easy

A. To delete all logs automatically every hour

B. To stop nginx from creating logs

C. To keep log files from growing too large and manage disk space

D. To combine all logs into one big file

Solution

1. Step 1: Understand log file growth

   Log files grow continuously as nginx runs, which can fill up disk space.

2. Step 2: Purpose of log rotation

   Log rotation splits logs into smaller files and removes or archives old ones to save space.

3. Final Answer:

   To keep log files from growing too large and manage disk space -> Option C

4. Quick Check:

   Log rotation = Manage log size and disk space [OK]

Hint: Log rotation prevents huge log files filling your disk [OK]

Common Mistakes:

• Thinking logs are deleted every hour automatically
• Believing log rotation stops logging
• Assuming logs are merged into one file

2. Which of the following is the correct directive to reload nginx after log rotation?

easy

A. systemctl restart nginx

B. nginx -s reload

C. service nginx stop

D. nginx --rotate-logs

Solution

1. Step 1: Identify nginx reload command

   The command nginx -s reload tells nginx to reload configuration and reopen log files without stopping the service.

2. Step 2: Compare other options

   systemctl restart nginx restarts nginx fully, which is heavier. service nginx stop stops nginx, and nginx --rotate-logs is not a valid command.

3. Final Answer:

   nginx -s reload -> Option B

4. Quick Check:

   Reload nginx logs = nginx -s reload [OK]

Hint: Use 'nginx -s reload' to reopen logs after rotation [OK]

Common Mistakes:

• Using full restart instead of reload
• Stopping nginx instead of reloading
• Using invalid nginx commands

3. Given this logrotate config snippet for nginx logs:

/var/log/nginx/*.log {
  daily
  missingok
  rotate 7
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
  sharedscripts
  postrotate
    nginx -s reload
  endscript
}

What happens when logrotate runs?

medium

A. Logs rotate daily, delete all old logs, and nginx stops

B. Logs rotate weekly, keep 7 uncompressed files, and nginx restarts

C. Logs never rotate because of syntax error

D. Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation

Solution

1. Step 1: Analyze rotation frequency and retention

   The daily directive means logs rotate every day. rotate 7 keeps 7 old log files.

2. Step 2: Check compression and reload

   compress compresses old logs, delaycompress delays compression by one cycle. postrotate runs nginx -s reload to reopen logs.

3. Final Answer:

   Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation -> Option D

4. Quick Check:

   Daily rotate + 7 files + reload nginx = C [OK]

Hint: Look for 'daily', 'rotate 7', and 'postrotate nginx -s reload' [OK]

Common Mistakes:

• Confusing daily with weekly rotation
• Ignoring compression directives
• Assuming nginx restarts instead of reloads

4. You configured logrotate for nginx but notice logs are not rotating. Which is the most likely cause?

medium

A. The log file path in logrotate config is incorrect

B. The compress directive is missing

C. The rotate number is set to 0

D. The postrotate script does not reload nginx

Solution

1. Step 1: Check log file path correctness

   If the log file path in the logrotate config does not match actual nginx log locations, rotation won't happen.

2. Step 2: Evaluate other options

   Not reloading nginx delays log reopening but rotation still occurs. rotate 0 disables rotation but is rare. Missing compress only affects compression, not rotation.

3. Final Answer:

   The log file path in logrotate config is incorrect -> Option A

4. Quick Check:

   Wrong log path = no rotation [OK]

Hint: Verify log file paths in config match actual nginx logs [OK]

Common Mistakes:

• Assuming missing reload stops rotation
• Thinking compression affects rotation
• Ignoring log file path accuracy

5. You want to rotate nginx logs only when they reach 100MB size, keep 5 backups, compress old logs, and reload nginx smoothly. Which logrotate config snippet achieves this?

hard

A. /var/log/nginx/*.log {
size 100M
rotate 5
compress
missingok
notifempty
sharedscripts
postrotate
nginx -s reload
endscript
}

B. /var/log/nginx/*.log {
daily
rotate 5
compress
postrotate
systemctl restart nginx
endscript
}

C. /var/log/nginx/*.log {
size 100M
rotate 10
delaycompress
postrotate
nginx -s reload
endscript
}

D. /var/log/nginx/*.log {
weekly
rotate 5
compress
postrotate
nginx -s reload
endscript
}

Solution

1. Step 1: Match size and rotate count requirements

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } uses size 100M to rotate at 100MB and rotate 5 to keep 5 backups, matching requirements.

2. Step 2: Check compression and reload commands

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } includes compress and postrotate nginx -s reload for smooth reload. Others use wrong rotate count, timing, or restart instead of reload.

3. Final Answer:

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } -> Option A

4. Quick Check:

   Size 100M + rotate 5 + compress + reload nginx = A [OK]

Hint: Look for 'size 100M', 'rotate 5', 'compress', and 'nginx -s reload' [OK]

Common Mistakes:

• Using daily or weekly instead of size-based rotation
• Restarting nginx instead of reloading
• Wrong rotate count or missing compress