Logs and logrotate

Logs record what your server and applications are doing, and logrotate is the tool that trims those files on a schedule so they do not fill the disk. Without rotation, a busy nginx access log or PHP error log can grow for weeks until the volume hits 100% and services stop writing. You keep enough history to debug last week’s problem, not years of old lines that crowd out MariaDB and backups.

How logrotate works on disk

logrotate reads /etc/logrotate.conf and the drop-in files under /etc/logrotate.d/. Each stanza names one or more log paths, how often to rotate, how many old copies to keep, and whether to compress them. Options such as missingok and notifempty keep the job quiet when a file is absent or empty. After a rotate, the writing process must reopen the new file. nginx needs a reopen signal rather than a full restart, or it keeps writing to the deleted inode until it exits.

Leaving debug logging on in production for a long stretch is a common way this layer fails. The disk fills, databases cannot grow, package tools cannot unpack, and the original error is missing because writes already stopped. Turn debug off when you finish, and copy any useful slice to another location first.

journald is a separate system

systemd’s journal is not managed by logrotate. It limits its own space with settings such as SystemMaxUse and RuntimeMaxUse in journald.conf. Distro defaults still apply if you never change them. Persistent storage needs Storage=persistent; otherwise a reboot can drop the panic that caused the reboot. Run journalctl --disk-usage when you want a quick check of how much space the journal is using.

Where web and cPanel logs belong

Do not write application logs into public_html. Visitors and scanners can read them there. On cPanel, account logs under ~/logs sit outside the document root on purpose and rotate on the node’s schedule. A WordPress plugin that drops debug.log into wp-content is a public file until you block it, and it still grows unless you disable it or add your own rotation.

On a VPS where you place a custom nginx or PHP-FPM log in a home directory, you own the logrotate stanza. A weekly rotate that keeps about four copies is enough for almost every site we host. Daily rotation with dozens of copies is how disks fill on a busy shop that also keeps local backups. More logs are not more observability when the volume is full and nothing new can be written.