Log rotation in Nginx - Step-by-Step Execution

Process Flow - Log rotation

Log file grows

↓

Check size/time limit

Yes↓

Rotate log: rename old

↓

Create new empty log

↓

Reload nginx to use new log

↓

Continue logging

Log rotation checks if the log file is too big or old, then renames it and creates a new log file, finally nginx reloads to write to the new log.

Execution Sample

Nginx

logrotate /etc/logrotate.d/nginx
systemctl reload nginx

This runs logrotate on nginx logs and reloads nginx to start logging to new files.

Process Table

Step	Action	Condition/Check	Result	System State Change
1	Check current nginx log file size	Is size > limit?	No	Log file continues growing
2	Check current nginx log file size	Is size > limit?	Yes	Prepare to rotate logs
3	Rename current log file	N/A	Old log renamed with timestamp	Old log saved
4	Create new empty log file	N/A	New log file created	New log ready for writing
5	Reload nginx service	N/A	Nginx reloads configuration	Nginx writes logs to new file
6	Continue logging	N/A	Logs written to new file	Logging continues smoothly

💡 Log rotation completes after nginx reloads and new log file is active

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	Final
log_file_size	growing	exceeds limit	exceeds limit	reset to 0	reset to 0	growing
log_file_name	nginx.log	nginx.log	nginx.log.1 (renamed)	nginx.log (new)	nginx.log (new)	nginx.log (new)
nginx_status	running	running	running	running	reloaded	running

Key Moments - 3 Insights

Why do we reload nginx after rotating logs?

Because nginx keeps the old log file open, reloading makes it close the old file and start writing to the new one, as shown in step 5 of the execution_table.

What happens if we don't create a new empty log file?

Nginx would fail to write logs after rotation because the new log file doesn't exist yet. Step 4 shows creating the new empty log file before reload.

How does logrotate decide when to rotate logs?

It checks conditions like file size or time interval. Step 2 shows checking if the log file size exceeds the limit to trigger rotation.

Visual Quiz - 3 Questions

Look at the execution_table, what is the system state after step 3?

A Nginx service reloaded

B Old log file renamed with timestamp

C New empty log file created

D Log file size reset to zero

💡 Hint

Check the 'Result' and 'System State Change' columns in step 3

At which step does nginx start writing logs to the new file?

A Step 5

B Step 4

C Step 6

D Step 3

💡 Hint

Look at the 'System State Change' column describing logging continuation

If the log file never exceeds the size limit, which step will never happen?

A Step 1

B Step 2

C Step 3

D Step 6

💡 Hint

Step 3 happens only if the condition in step 2 is Yes

Concept Snapshot

Log rotation renames old logs and creates new ones to prevent huge files.
It checks size or time limits to decide when to rotate.
After rotation, nginx must reload to write to new logs.
Commands: logrotate config + systemctl reload nginx.
This keeps logs manageable and nginx logging continuous.

Full Transcript

Log rotation in nginx works by monitoring the log file size or age. When the log file grows too large or reaches a time limit, the system renames the current log file to save it as an old log with a timestamp. Then, it creates a new empty log file for nginx to write fresh logs. To make nginx start writing to the new log file, the nginx service is reloaded. This process prevents log files from becoming too big and keeps logging smooth. The key steps are checking the log size, renaming the old log, creating a new log, and reloading nginx. Without reloading, nginx would continue writing to the old file. This cycle repeats as logs grow over time.