| xz -6<\/td> | ~16x<\/td> | very slow<\/td> | very high<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n On a low-core VPS, zstd at level 3 or 6 is the sweet spot: near-gzip ratios at a fraction of the CPU, so a nightly rotation does not spike load. Reserve xz for archives you compress once and query rarely. Verify a codec is available before switching, or logrotate will fail the whole stanza:<\/p>\n\n\n\n command -v zstd zstdcat xz\n\n# dry-run the new config across all matching logs\nlogrotate --debug \/etc\/logrotate.d\/nginx\n\n# force a rotation now, outside the cron window\nlogrotate --force \/etc\/logrotate.d\/nginx<\/code><\/pre>\n\n\n\nRetention by size, not just by count<\/h2>\n\n\n\nrotate N<\/code> caps the number of archives, but a file that grows tenfold suddenly means ten times the disk. Cap total size too, using maxsize<\/code> to rotate early.<\/p>\n\n\n\n# rotate early if the file exceeds 200 MB, regardless of count\n\/var\/log\/app\/*.log {\n daily\n rotate 10\n maxsize 200M\n compress\n copytruncate # use when the app cannot reopen its log fd\n}<\/code><\/pre>\n\n\n\ncopytruncate<\/code> is convenient but has a race window where a few lines can be lost between copy and truncate; prefer postrotate<\/code> + signal whenever the application supports reopening its file descriptors.<\/p>\n\n\n\nThe journald side of the equation<\/h2>\n\n\n\nOn systemd hosts, \/var\/log\/journal<\/code> grows independently of logrotate and is a frequent hidden consumer. Cap it explicitly:<\/p>\n\n\n\n# \/etc\/systemd\/journald.conf\nSystemMaxUse=200M\nSystemMaxFileSize=50M\nMaxRetentionSec=2week\n\nsystemctl restart systemd-journald\njournalctl --disk-usage\njournalctl --vacuum-size=200M<\/code><\/pre>\n\n\n\nPer-application retention that matches value<\/h2>\n\n\n\nNot every log deserves the same lifespan. Access logs are forensic evidence; debug logs from an application are transient noise. Splitting retention by value is how you keep two weeks of the first and two days of the second on the same disk.<\/p>\n\n\n\n # high-value: keep, compress well, never lose\n\/var\/log\/nginx\/*.log {\n daily\n rotate 30\n compress\n delaycompress\n dateext\n}\n\n# noisy debug output: short window, aggressive cap\n\/var\/log\/app\/debug.log {\n daily\n rotate 3\n maxsize 100M\n compress\n copytruncate\n missingok\n notifempty\n}<\/code><\/pre>\n\n\n\nTwo details matter here. notifempty<\/code> prevents rotation churn on logs that stayed silent. And mixing dateext<\/code> only on the high-value stanza keeps the debug directory simple while giving the forensic logs stable, sortable filenames.<\/p>\n\n\n\nRotation timing and the cron window<\/h2>\n\n\n\nlogrotate is normally invoked by a systemd timer once per day. If you add a fresh \/etc\/logrotate.d<\/code> stanza after that window has passed, nothing happens until tomorrow \u2014 the single most common reason a new policy appears to be ignored.<\/p>\n\n\n\n# who triggers rotation on modern Debian\/Ubuntu\nsystemctl list-timers logrotate.timer\n\n# inspect what the daily job actually iterates over\ngrep -v '^#' \/etc\/logrotate.conf\n\n# test a single stanza without waiting for the timer\nlogrotate --force --verbose \/etc\/logrotate.d\/nginx<\/code><\/pre>\n\n\n\nUse --force<\/code> sparingly in production: it rotates immediately regardless of the size or age conditions, which is exactly what you want while validating a config and exactly what you do not want on a live database host mid-day.<\/p>\n\n\n\nPreventing rotation from failing silently<\/h2>\n\n\n\nA misconfigured stanza fails quietly and leaves the previous archives intact, so disk usage climbs with no obvious error. logrotate writes its state to a status file; a healthy run updates the timestamp, and a repeated failure shows a stale entry.<\/p>\n\n\n\n # last successful rotation per log\ncat \/var\/lib\/logrotate\/status | grep \/var\/log\/nginx\n\n# capture errors from a manual run\nlogrotate --verbose --debug \/etc\/logrotate.d\/nginx 2>&1 | tail -20\n\n# catch failures in a timer-driven setup\nsystemctl status logrotate.service --no-pager<\/code><\/pre>\n\n\n\n- Missing
compresscmd<\/code> binary → whole stanza skipped.<\/li>- Bad glob with no
missingok<\/code> → stanza errors and stops.<\/li>postrotate<\/code> signal sent to a stopped service → old file kept open, space not reclaimed.<\/li>- Permissions on the
create<\/code> line wrong for the daemon → app cannot write after the first rotation.<\/li><\/ul>\n\n\n\nReclaiming space from archives you will never read<\/h2>\n\n\n\nOld compressed archives are the cheapest thing to delete, so build the habit of inspecting before purging. Because dateext<\/code> encodes the date in the filename, retention becomes a simple text filter.<\/p>\n\n\n\n# how much space is sitting in archives, by month\ndu -ch \/var\/log\/nginx\/*.zst 2>\/dev\/null | tail -1\n\n# list archives older than 30 days before removing anything\nfind \/var\/log -name '*.zst' -mtime +30 -printf '%TY-%Tm-%Td %10s %p\\n' | sort\n\n# grep a rotated log without decompressing to disk\nzstdcat \/var\/log\/nginx\/access.log-20260101.zst | grep ' 500 '<\/code><\/pre>\n\n\n\nSearching compressed logs in place with zstdcat<\/code> keeps the convenience of plain text without paying the disk cost of decompression. This is the reason delaycompress<\/code> exists: the most recent archive stays readable by ordinary tools during the window when you are most likely to need it.<\/p>\n\n\n\nA lightweight disk-capacity guard<\/h2>\n\n\n\nEven a perfect policy benefits from an independent watchdog. A tiny script on a timer that alerts when \/var<\/code> crosses a threshold turns a future outage into a routine notification.<\/p>\n\n\n\n#!\/bin\/sh\n# \/usr\/local\/bin\/disk-guard.sh\nTHRESH=80\nUSE=$(df --output=pcent \/var | tail -1 | tr -d ' %')\n[ \"$USE\" -ge \"$THRESH\" ] && \\\n logger -t disk-guard \"WARNING: \/var at ${USE}%\" && \\\n du -xh --max-depth=1 \/var\/log | sort -h | tail -5 | logger -t disk-guard<\/code><\/pre>\n\n\n\n
|