How should I plan server log rotation and retention?
Log rotation controls active file growth; retention controls how long older records remain available. Plan both with the application’s logging method and investigation needs in mind. Deleting a large live log is not a substitute for a tested rotation policy.
Before you start
- An inventory of application, system and security logs with their owners and storage locations.
Instructions
1. Understand each logging mechanism
Identify plain files, systemd journal, Windows Event Logs, container logging drivers and remote collectors. Check whether a service needs a supported reopen signal or reload after a file rotates. Avoid applying one file-based rotation rule to a logging system that manages its own storage.
2. Define capacity and retention
Set a storage budget and retention period appropriate to operational investigation and the data owner’s requirements. Include compression, forwarding and access restrictions where supported. Avoid logging passwords, tokens or unnecessary personal data; longer retention increases the amount of sensitive material that must be protected.
3. Validate the complete cycle
Use the tool’s supported validation or preview, then observe an approved normal rotation. Confirm that new records continue to arrive, older records remain searchable as intended and storage usage is bounded. Preserve required incident records before any scheduled expiry or cleanup affects them.
Check the result
- The application continues logging after rotation and retained records are readable by authorised staff.
- Storage growth stays within the approved budget without silently dropping essential evidence.
Troubleshooting
- A log was removed but disk space did not return
- A process may still hold the deleted file open. Identify the responsible service and use its supported log-reopen process; do not kill unrelated processes or repeatedly delete more files.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.