Log rotation in Nginx - Step-by-Step Execution

Process Flow - Log rotation

Log file grows

↓

Check size/time limit

Yes↓

Rotate log: rename old

↓

Create new empty log

↓

Reload nginx to use new log

↓

Continue logging

Log rotation checks if the log file is too big or old, then renames it and creates a new log file, finally nginx reloads to write to the new log.

Execution Sample

Nginx

logrotate /etc/logrotate.d/nginx
systemctl reload nginx

This runs logrotate on nginx logs and reloads nginx to start logging to new files.

Process Table

Step	Action	Condition/Check	Result	System State Change
1	Check current nginx log file size	Is size > limit?	No	Log file continues growing
2	Check current nginx log file size	Is size > limit?	Yes	Prepare to rotate logs
3	Rename current log file	N/A	Old log renamed with timestamp	Old log saved
4	Create new empty log file	N/A	New log file created	New log ready for writing
5	Reload nginx service	N/A	Nginx reloads configuration	Nginx writes logs to new file
6	Continue logging	N/A	Logs written to new file	Logging continues smoothly

💡 Log rotation completes after nginx reloads and new log file is active

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	Final
log_file_size	growing	exceeds limit	exceeds limit	reset to 0	reset to 0	growing
log_file_name	nginx.log	nginx.log	nginx.log.1 (renamed)	nginx.log (new)	nginx.log (new)	nginx.log (new)
nginx_status	running	running	running	running	reloaded	running

Key Moments - 3 Insights

Why do we reload nginx after rotating logs?

Because nginx keeps the old log file open, reloading makes it close the old file and start writing to the new one, as shown in step 5 of the execution_table.

What happens if we don't create a new empty log file?

Nginx would fail to write logs after rotation because the new log file doesn't exist yet. Step 4 shows creating the new empty log file before reload.

How does logrotate decide when to rotate logs?

It checks conditions like file size or time interval. Step 2 shows checking if the log file size exceeds the limit to trigger rotation.

Visual Quiz - 3 Questions

Look at the execution_table, what is the system state after step 3?

A Nginx service reloaded

B Old log file renamed with timestamp

C New empty log file created

D Log file size reset to zero

💡 Hint

Check the 'Result' and 'System State Change' columns in step 3

At which step does nginx start writing logs to the new file?

A Step 5

B Step 4

C Step 6

D Step 3

💡 Hint

Look at the 'System State Change' column describing logging continuation

If the log file never exceeds the size limit, which step will never happen?

A Step 1

B Step 2

C Step 3

D Step 6

💡 Hint

Step 3 happens only if the condition in step 2 is Yes

Concept Snapshot

Log rotation renames old logs and creates new ones to prevent huge files.
It checks size or time limits to decide when to rotate.
After rotation, nginx must reload to write to new logs.
Commands: logrotate config + systemctl reload nginx.
This keeps logs manageable and nginx logging continuous.

Full Transcript

Log rotation in nginx works by monitoring the log file size or age. When the log file grows too large or reaches a time limit, the system renames the current log file to save it as an old log with a timestamp. Then, it creates a new empty log file for nginx to write fresh logs. To make nginx start writing to the new log file, the nginx service is reloaded. This process prevents log files from becoming too big and keeps logging smooth. The key steps are checking the log size, renaming the old log, creating a new log, and reloading nginx. Without reloading, nginx would continue writing to the old file. This cycle repeats as logs grow over time.

Practice

1. What is the main purpose of log rotation in nginx?

easy

A. To delete all logs automatically every hour

B. To stop nginx from creating logs

C. To keep log files from growing too large and manage disk space

D. To combine all logs into one big file

Solution

1. Step 1: Understand log file growth

   Log files grow continuously as nginx runs, which can fill up disk space.

2. Step 2: Purpose of log rotation

   Log rotation splits logs into smaller files and removes or archives old ones to save space.

3. Final Answer:

   To keep log files from growing too large and manage disk space -> Option C

4. Quick Check:

   Log rotation = Manage log size and disk space [OK]

Hint: Log rotation prevents huge log files filling your disk [OK]

Common Mistakes:

• Thinking logs are deleted every hour automatically
• Believing log rotation stops logging
• Assuming logs are merged into one file

2. Which of the following is the correct directive to reload nginx after log rotation?

easy

A. systemctl restart nginx

B. nginx -s reload

C. service nginx stop

D. nginx --rotate-logs

Solution

1. Step 1: Identify nginx reload command

   The command nginx -s reload tells nginx to reload configuration and reopen log files without stopping the service.

2. Step 2: Compare other options

   systemctl restart nginx restarts nginx fully, which is heavier. service nginx stop stops nginx, and nginx --rotate-logs is not a valid command.

3. Final Answer:

   nginx -s reload -> Option B

4. Quick Check:

   Reload nginx logs = nginx -s reload [OK]

Hint: Use 'nginx -s reload' to reopen logs after rotation [OK]

Common Mistakes:

• Using full restart instead of reload
• Stopping nginx instead of reloading
• Using invalid nginx commands

3. Given this logrotate config snippet for nginx logs:

/var/log/nginx/*.log {
  daily
  missingok
  rotate 7
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
  sharedscripts
  postrotate
    nginx -s reload
  endscript
}

What happens when logrotate runs?

medium

A. Logs rotate daily, delete all old logs, and nginx stops

B. Logs rotate weekly, keep 7 uncompressed files, and nginx restarts

C. Logs never rotate because of syntax error

D. Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation

Solution

1. Step 1: Analyze rotation frequency and retention

   The daily directive means logs rotate every day. rotate 7 keeps 7 old log files.

2. Step 2: Check compression and reload

   compress compresses old logs, delaycompress delays compression by one cycle. postrotate runs nginx -s reload to reopen logs.

3. Final Answer:

   Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation -> Option D

4. Quick Check:

   Daily rotate + 7 files + reload nginx = C [OK]

Hint: Look for 'daily', 'rotate 7', and 'postrotate nginx -s reload' [OK]

Common Mistakes:

• Confusing daily with weekly rotation
• Ignoring compression directives
• Assuming nginx restarts instead of reloads

4. You configured logrotate for nginx but notice logs are not rotating. Which is the most likely cause?

medium

A. The log file path in logrotate config is incorrect

B. The compress directive is missing

C. The rotate number is set to 0

D. The postrotate script does not reload nginx

Solution

1. Step 1: Check log file path correctness

   If the log file path in the logrotate config does not match actual nginx log locations, rotation won't happen.

2. Step 2: Evaluate other options

   Not reloading nginx delays log reopening but rotation still occurs. rotate 0 disables rotation but is rare. Missing compress only affects compression, not rotation.

3. Final Answer:

   The log file path in logrotate config is incorrect -> Option A

4. Quick Check:

   Wrong log path = no rotation [OK]

Hint: Verify log file paths in config match actual nginx logs [OK]

Common Mistakes:

• Assuming missing reload stops rotation
• Thinking compression affects rotation
• Ignoring log file path accuracy

5. You want to rotate nginx logs only when they reach 100MB size, keep 5 backups, compress old logs, and reload nginx smoothly. Which logrotate config snippet achieves this?

hard

A. /var/log/nginx/*.log {
size 100M
rotate 5
compress
missingok
notifempty
sharedscripts
postrotate
nginx -s reload
endscript
}

B. /var/log/nginx/*.log {
daily
rotate 5
compress
postrotate
systemctl restart nginx
endscript
}

C. /var/log/nginx/*.log {
size 100M
rotate 10
delaycompress
postrotate
nginx -s reload
endscript
}

D. /var/log/nginx/*.log {
weekly
rotate 5
compress
postrotate
nginx -s reload
endscript
}

Solution

1. Step 1: Match size and rotate count requirements

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } uses size 100M to rotate at 100MB and rotate 5 to keep 5 backups, matching requirements.

2. Step 2: Check compression and reload commands

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } includes compress and postrotate nginx -s reload for smooth reload. Others use wrong rotate count, timing, or restart instead of reload.

3. Final Answer:

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } -> Option A

4. Quick Check:

   Size 100M + rotate 5 + compress + reload nginx = A [OK]

Hint: Look for 'size 100M', 'rotate 5', 'compress', and 'nginx -s reload' [OK]

Common Mistakes:

• Using daily or weekly instead of size-based rotation
• Restarting nginx instead of reloading
• Wrong rotate count or missing compress