Why Log rotation in Nginx? - Purpose & Use Cases

The Big Idea

What if your server suddenly stops because logs filled up the disk? Log rotation saves you from that nightmare.

The Scenario

Imagine you run a busy website using nginx. Every day, your server creates huge log files recording every visitor and error. Without managing these logs, they keep growing and take up all your disk space.

The Problem

Manually checking and deleting or moving log files is slow and easy to forget. If logs grow too big, your server can slow down or crash. Also, important information might get lost if you delete logs carelessly.

The Solution

Log rotation automatically renames and compresses old log files and starts fresh ones. This keeps logs organized, saves disk space, and ensures your server runs smoothly without manual work.

Before vs After

✗ Before

rm /var/log/nginx/access.log
mv /var/log/nginx/access.log.1 /backup/

✓ After

logrotate /etc/logrotate.d/nginx

What It Enables

Log rotation lets your server handle logs efficiently, so you never run out of space and always keep important data safe.

Real Life Example

A busy online store uses log rotation to keep daily sales logs manageable and quickly find issues without worrying about disk space running out.

Key Takeaways

Manual log management is slow and risky.

Log rotation automates organizing and compressing logs.

This keeps servers stable and logs accessible.

Practice

1. What is the main purpose of log rotation in nginx?

easy

A. To delete all logs automatically every hour

B. To stop nginx from creating logs

C. To keep log files from growing too large and manage disk space

D. To combine all logs into one big file

Solution

1. Step 1: Understand log file growth

   Log files grow continuously as nginx runs, which can fill up disk space.

2. Step 2: Purpose of log rotation

   Log rotation splits logs into smaller files and removes or archives old ones to save space.

3. Final Answer:

   To keep log files from growing too large and manage disk space -> Option C

4. Quick Check:

   Log rotation = Manage log size and disk space [OK]

Hint: Log rotation prevents huge log files filling your disk [OK]

Common Mistakes:

• Thinking logs are deleted every hour automatically
• Believing log rotation stops logging
• Assuming logs are merged into one file

2. Which of the following is the correct directive to reload nginx after log rotation?

easy

A. systemctl restart nginx

B. nginx -s reload

C. service nginx stop

D. nginx --rotate-logs

Solution

1. Step 1: Identify nginx reload command

   The command nginx -s reload tells nginx to reload configuration and reopen log files without stopping the service.

2. Step 2: Compare other options

   systemctl restart nginx restarts nginx fully, which is heavier. service nginx stop stops nginx, and nginx --rotate-logs is not a valid command.

3. Final Answer:

   nginx -s reload -> Option B

4. Quick Check:

   Reload nginx logs = nginx -s reload [OK]

Hint: Use 'nginx -s reload' to reopen logs after rotation [OK]

Common Mistakes:

• Using full restart instead of reload
• Stopping nginx instead of reloading
• Using invalid nginx commands

3. Given this logrotate config snippet for nginx logs:

/var/log/nginx/*.log {
  daily
  missingok
  rotate 7
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
  sharedscripts
  postrotate
    nginx -s reload
  endscript
}

What happens when logrotate runs?

medium

A. Logs rotate daily, delete all old logs, and nginx stops

B. Logs rotate weekly, keep 7 uncompressed files, and nginx restarts

C. Logs never rotate because of syntax error

D. Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation

Solution

1. Step 1: Analyze rotation frequency and retention

   The daily directive means logs rotate every day. rotate 7 keeps 7 old log files.

2. Step 2: Check compression and reload

   compress compresses old logs, delaycompress delays compression by one cycle. postrotate runs nginx -s reload to reopen logs.

3. Final Answer:

   Logs rotate daily, keep 7 old compressed files, and nginx reloads after rotation -> Option D

4. Quick Check:

   Daily rotate + 7 files + reload nginx = C [OK]

Hint: Look for 'daily', 'rotate 7', and 'postrotate nginx -s reload' [OK]

Common Mistakes:

• Confusing daily with weekly rotation
• Ignoring compression directives
• Assuming nginx restarts instead of reloads

4. You configured logrotate for nginx but notice logs are not rotating. Which is the most likely cause?

medium

A. The log file path in logrotate config is incorrect

B. The compress directive is missing

C. The rotate number is set to 0

D. The postrotate script does not reload nginx

Solution

1. Step 1: Check log file path correctness

   If the log file path in the logrotate config does not match actual nginx log locations, rotation won't happen.

2. Step 2: Evaluate other options

   Not reloading nginx delays log reopening but rotation still occurs. rotate 0 disables rotation but is rare. Missing compress only affects compression, not rotation.

3. Final Answer:

   The log file path in logrotate config is incorrect -> Option A

4. Quick Check:

   Wrong log path = no rotation [OK]

Hint: Verify log file paths in config match actual nginx logs [OK]

Common Mistakes:

• Assuming missing reload stops rotation
• Thinking compression affects rotation
• Ignoring log file path accuracy

5. You want to rotate nginx logs only when they reach 100MB size, keep 5 backups, compress old logs, and reload nginx smoothly. Which logrotate config snippet achieves this?

hard

A. /var/log/nginx/*.log {
size 100M
rotate 5
compress
missingok
notifempty
sharedscripts
postrotate
nginx -s reload
endscript
}

B. /var/log/nginx/*.log {
daily
rotate 5
compress
postrotate
systemctl restart nginx
endscript
}

C. /var/log/nginx/*.log {
size 100M
rotate 10
delaycompress
postrotate
nginx -s reload
endscript
}

D. /var/log/nginx/*.log {
weekly
rotate 5
compress
postrotate
nginx -s reload
endscript
}

Solution

1. Step 1: Match size and rotate count requirements

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } uses size 100M to rotate at 100MB and rotate 5 to keep 5 backups, matching requirements.

2. Step 2: Check compression and reload commands

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } includes compress and postrotate nginx -s reload for smooth reload. Others use wrong rotate count, timing, or restart instead of reload.

3. Final Answer:

   /var/log/nginx/*.log { size 100M rotate 5 compress missingok notifempty sharedscripts postrotate nginx -s reload endscript } -> Option A

4. Quick Check:

   Size 100M + rotate 5 + compress + reload nginx = A [OK]

Hint: Look for 'size 100M', 'rotate 5', 'compress', and 'nginx -s reload' [OK]

Common Mistakes:

• Using daily or weekly instead of size-based rotation
• Restarting nginx instead of reloading
• Wrong rotate count or missing compress