Log rotation in Nginx - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is log rotation in the context of nginx?

Log rotation is the process of renaming and archiving old log files and creating new ones to prevent logs from growing too large and consuming too much disk space.

beginner

Which tool is commonly used to automate log rotation for nginx logs on Linux systems?

The logrotate tool is commonly used to automate log rotation for nginx logs on Linux systems.

intermediate

What is the purpose of the postrotate script in a logrotate configuration for nginx?

The postrotate script runs commands after rotating logs, usually to tell nginx to reopen its log files so it writes to the new log files.

intermediate

Show a simple logrotate configuration snippet for nginx access logs.

Example configuration:

/var/log/nginx/access.log {
  daily
  missingok
  rotate 7
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
  sharedscripts
  postrotate
    systemctl reload nginx > /dev/null 2>&1 || true
  endscript
}

beginner

Why is it important to reload or restart nginx after log rotation?

Reloading nginx after log rotation makes nginx close the old log files and open new ones, so it continues logging correctly without losing data.

What does the rotate 7 directive mean in a logrotate config?

A Create 7 new log files

B Rotate logs every 7 minutes

C Keep 7 old log files before deleting

D Compress logs 7 times

The rotate 7 directive means to keep 7 old log files before removing the oldest.

Which command is typically used inside postrotate to reload nginx?

A systemctl reload nginx

B nginx -s stop

C service nginx restart

D killall nginx

The command systemctl reload nginx tells nginx to reload its configuration and reopen log files.

What happens if nginx is not reloaded after log rotation?

A Nginx crashes

B Nginx continues writing to old log files

C Nginx creates new log files automatically

D Nginx stops logging completely

Without reload, nginx keeps writing to the old (rotated) log files, which can cause confusion and disk space issues.

Which of these is NOT a common logrotate option?

A compress

B delaycompress

C rotate

D restart

There is no restart option in logrotate; reloading or restarting services is done in scripts like postrotate.

Where are nginx log files usually located on a Linux system?

A /var/log/nginx/

B /etc/nginx/logs/

C /usr/nginx/logs/

D /home/nginx/logs/

Nginx log files are typically stored in /var/log/nginx/.

Explain how log rotation works for nginx logs and why it is important.

Think about what happens when logs grow too big and how nginx handles log files.

Describe a basic logrotate configuration for nginx logs including key directives and scripts.

Focus on the main parts of a logrotate config and how it interacts with nginx.

Practice

1. What is the main purpose of log rotation in nginx?

easy

A. To delete all logs automatically every hour

B. To stop nginx from creating logs

C. To keep log files from growing too large and manage disk space

D. To combine all logs into one big file

Solution

1. Step 1: Understand log file growth

   Log files grow continuously as nginx runs, which can fill up disk space.

2. Step 2: Purpose of log rotation

   Log rotation splits logs into smaller files and removes or archives old ones to save space.

3. Final Answer:

   To keep log files from growing too large and manage disk space -> Option C

4. Quick Check:

   Log rotation = Manage log size and disk space [OK]

Hint: Log rotation prevents huge log files filling your disk [OK]

Common Mistakes:

• Thinking logs are deleted every hour automatically
• Believing log rotation stops logging
• Assuming logs are merged into one file

2. Which of the following is the correct directive to reload nginx after log rotation?

easy

A. systemctl restart nginx

B. nginx -s reload

C. service nginx stop

D. nginx --rotate-logs

Solution

1. Step 1: Identify nginx reload command

   The command nginx -s reload tells nginx to reload configuration and reopen log files without stopping the service.

2. Step 2: Compare other options

   systemctl restart nginx restarts nginx fully, which is heavier. service nginx stop stops nginx, and nginx --rotate-logs is not a valid command.

3. Final Answer:

   nginx -s reload -> Option B

4. Quick Check:

   Reload nginx logs = nginx -s reload [OK]

Hint: Use 'nginx -s reload' to reopen logs after rotation [OK]

Common Mistakes:

• Using full restart instead of reload
• Stopping nginx instead of reloading
• Using invalid nginx commands

3. Given this logrotate config snippet for nginx logs:

/var/log/nginx/*.log {
  daily
  missingok
  rotate 7
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
  sharedscripts
  postrotate
    nginx -s reload
  endscript
}

What happens when logrotate runs?

medium

A. Logs rotate daily, delete all old logs, and nginx stops

B. Logs rotate weekly, keep 7 uncompressed files, and nginx restarts

C. Logs never rotate because of syntax error

D. Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation

Solution

1. Step 1: Analyze rotation frequency and retention

   The daily directive means logs rotate every day. rotate 7 keeps 7 old log files.

2. Step 2: Check compression and reload

   compress compresses old logs, delaycompress delays compression by one cycle. postrotate runs nginx -s reload to reopen logs.

3. Final Answer:

   Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation -> Option D

4. Quick Check:

   Daily rotate + 7 files + reload nginx = C [OK]

Hint: Look for 'daily', 'rotate 7', and 'postrotate nginx -s reload' [OK]

Common Mistakes:

• Confusing daily with weekly rotation
• Ignoring compression directives
• Assuming nginx restarts instead of reloads

4. You configured logrotate for nginx but notice logs are not rotating. Which is the most likely cause?

medium

A. The log file path in logrotate config is incorrect

B. The compress directive is missing

C. The rotate number is set to 0

D. The postrotate script does not reload nginx

Solution

1. Step 1: Check log file path correctness

   If the log file path in the logrotate config does not match actual nginx log locations, rotation won't happen.

2. Step 2: Evaluate other options

   Not reloading nginx delays log reopening but rotation still occurs. rotate 0 disables rotation but is rare. Missing compress only affects compression, not rotation.

3. Final Answer:

   The log file path in logrotate config is incorrect -> Option A

4. Quick Check:

   Wrong log path = no rotation [OK]

Hint: Verify log file paths in config match actual nginx logs [OK]

Common Mistakes:

• Assuming missing reload stops rotation
• Thinking compression affects rotation
• Ignoring log file path accuracy

5. You want to rotate nginx logs only when they reach 100MB size, keep 5 backups, compress old logs, and reload nginx smoothly. Which logrotate config snippet achieves this?

hard

A. /var/log/nginx/*.log {
size 100M
rotate 5
compress
missingok
notifempty
sharedscripts
postrotate
nginx -s reload
endscript
}

B. /var/log/nginx/*.log {
daily
rotate 5
compress
postrotate
systemctl restart nginx
endscript
}

C. /var/log/nginx/*.log {
size 100M
rotate 10
delaycompress
postrotate
nginx -s reload
endscript
}

D. /var/log/nginx/*.log {
weekly
rotate 5
compress
postrotate
nginx -s reload
endscript
}

Solution

1. Step 1: Match size and rotate count requirements

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } uses size 100M to rotate at 100MB and rotate 5 to keep 5 backups, matching requirements.

2. Step 2: Check compression and reload commands

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } includes compress and postrotate nginx -s reload for smooth reload. Others use wrong rotate count, timing, or restart instead of reload.

3. Final Answer:

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } -> Option A

4. Quick Check:

   Size 100M + rotate 5 + compress + reload nginx = A [OK]

Hint: Look for 'size 100M', 'rotate 5', 'compress', and 'nginx -s reload' [OK]

Common Mistakes:

• Using daily or weekly instead of size-based rotation
• Restarting nginx instead of reloading
• Wrong rotate count or missing compress