Production Log Management with

Production Log Management on Linux: Mastering logrotate for High-Uptime Servers

Unmanaged log growth is one of the most common causes of unexpected production outages. When application or web server logs fill up host disk partitions, database transactions fail, services crash, and systems become un-writeable.

Linux provides a built-in utility called logrotate to automatically compress, rotate, and archive old log files.

---

1. Understanding logrotate Structure

System logrotate configurations are split between two main locations:

• /etc/logrotate.conf — Global baseline configurations.
• /etc/logrotate.d/ — Service-specific configuration files (e.g., Nginx, Docker, custom apps).

2. Creating a Custom Application Log Rule

Create a rule file for a custom production web service at /etc/logrotate.d/jam-app:

/var/log/jam-app/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data www-data
    sharedscripts
    postrotate
        systemctl reload jam-app.service > /dev/null 2>&1 || true
    endscript
}

3. Key Directives Explained

Directive	Operational Purpose
daily	Rotates logs every 24 hours. Alternatives: weekly, monthly.
rotate 14	Retains 14 rotated log files before purging the oldest archive.
compress	Compresses old logs using Gzip (.gz) to save up to 90% disk space.
delaycompress	Postpones compression of the most recent rotated file to the next cycle to prevent file-lock conflicts.

4. Testing Log Rotation Without Execution

Always test your rules using dry-run mode before deploying to production:

# Run logrotate in debug/dry-run mode
sudo logrotate -d /etc/logrotate.d/jam-app

# Force an immediate manual rotation
sudo logrotate -f /etc/logrotate.d/jam-app