Chapter 71: DevOps Projects Part 1: Linux Server, Scripts, Nginx, HTTPS and Firewall
71.3 Project 3: Log rotation and cleanup cron job
Friends, logs grow every minute. Today we set logrotate rules and a cleanup cron so old logs leave the disk before it fills. We test with dry-run, then install.
मित्रांनो, logs दर मिनिटाला वाढतात. आज logrotate नियम आणि cleanup cron सेट करू जेणेकरून जुने logs disk भरण्यापूर्वी निघतील. Dry-run नंतर install.
दोस्तों, logs हर मिनट बढ़ते हैं. आज logrotate नियम और cleanup cron सेट करेंगे ताकि पुराने logs disk भरने से पहले निकल जाएँ. Dry-run के बाद install.
What you will build in this project
- A logrotate rule for an app log.
- A cleanup script for temp files older than N days.
- Cron schedule that runs daily.
- A dry-run that proves nothing breaks.
1. Start from a real company story
At Flipkart in Bengaluru, the order-service log grew by 2 GB every night. On Diwali sale week the disk hit 98 percent and checkout slowed.
Neha found /var/log/order-service/app.log was never rotated. Debug was left on for a week.
She wrote a logrotate rule and a cleanup cron for /tmp/order-*.tmp files older than 3 days.
The fix cost one afternoon. The sale weekend stayed calm. Cost avoided: about ₹18 lakh in lost orders.
Ravindra Bagale's Tip
Many students delete logs by hand with rm. Prefer logrotate and find -mtime. Keep that habit.
खूप students logs हाताने rm ने काढतात. logrotate आणि find -mtime वापरा. सवय ठेवा.
बहुत students logs हाथ से rm से हटाते हैं. logrotate और find -mtime इस्तेमाल करें. आदत रखिए.
2. Start and prepare
Step 1: Check the log file size
Why: We must know how big the log is before we act. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: du and ls show size. We read both. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 1: Show log size
Type this:
sudo du -h /var/log/order-service/app.log 2>/dev/null || (sudo mkdir -p /var/log/order-service; sudo dd if=/dev/zero of=/var/log/order-service/app.log bs=1M count=120 status=none; sudo du -h /var/log/order-service/app.log)
You will see:
120M /var/log/order-service/app.log
What it means: 120 MB practice log.
Example 2: List log dir
Type this:
sudo ls -lh /var/log/order-service/
You will see:
-rw-r--r-- 1 root root 120M Oct 28 11:00 app.log
What it means: One fat file.
Example 3: Disk percent
Type this:
df -P /var | awk 'NR==2{print $5,$6}'
You will see:
62% /var
What it means: Baseline before cleanup.
Step 2: Install logrotate if missing
Why: We need the rotator tool present. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: apt installs logrotate on Ubuntu. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 4: Install logrotate
Type this:
sudo apt-get install -y logrotate 2>&1 | tail -2
You will see:
logrotate is already the newest version.
0 upgraded, 0 newly installed
What it means: Usually present.
Example 5: Version
Type this:
logrotate --version | head -1
You will see:
logrotate 3.21.0
What it means: Version line for notes.
Example 6: Default state
Type this:
systemctl is-enabled logrotate.timer 2>/dev/null || ls /etc/cron.daily/logrotate
You will see:
enabled
What it means: Daily timer or cron.daily.
Step 3: Write a drop-in rule
Why: A drop-in keeps the main config clean. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: /etc/logrotate.d/ holds one file per app. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 7: Write rule
Type this:
printf '%s\n' '/var/log/order-service/*.log {' ' daily' ' rotate 7' ' compress' ' delaycompress' ' missingok' ' notifempty' ' copytruncate' '}' | sudo tee /etc/logrotate.d/order-service >/dev/null && echo ok
You will see:
ok
What it means: Seven days, compress, copytruncate for open files.
Example 8: Show rule
Type this:
cat /etc/logrotate.d/order-service
You will see:
/var/log/order-service/*.log {
daily
rotate 7
compress
delaycompress
missingok
notifempty
copytruncate
}
What it means: Readable drop-in.
Example 9: Mode
Type this:
stat -c '%a %n' /etc/logrotate.d/order-service
You will see:
644 /etc/logrotate.d/order-service
What it means: Root-owned, world-readable OK for rules.
3. Build the main pieces
Step 4: Force a rotation once
Why: Forcing once proves the rule. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: logrotate -f runs now. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 10: Debug rule
Type this:
sudo logrotate -d /etc/logrotate.d/order-service 2>&1 | tail -4
You will see:
reading config file order-service
Handling 1 logs
rotating log /var/log/order-service/app.log, log->rotateCount is 7
What it means: Dry debug looks good.
Example 11: Force rotate
Type this:
sudo logrotate -f /etc/logrotate.d/order-service && sudo ls /var/log/order-service/
You will see:
app.log
app.log.1
What it means: Rotated once.
Example 12: Compress next day
Type this:
sudo touch -d '2 days ago' /var/log/order-service/app.log.1; sudo logrotate -f /etc/logrotate.d/order-service; sudo ls /var/log/order-service/
You will see:
app.log
app.log.1
app.log.2.gz
What it means: delaycompress gzips yesterday.
Step 5: Write cleanup-tmp.sh
Why: Temp files need a second cleaner. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: find + mtime selects old temps. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 13: Create cleanup script
Type this:
printf '%s\n' '#!/usr/bin/env bash' 'set -euo pipefail' 'DIR=${DIR:-/tmp}' 'DAYS=${DAYS:-3}' 'find "$DIR" -type f -name "order-*.tmp" -mtime +$DAYS -print' > /tmp/cleanup-tmp.sh && sudo mv /tmp/cleanup-tmp.sh /usr/local/bin/cleanup-tmp.sh && sudo chmod 755 /usr/local/bin/cleanup-tmp.sh && head -5 /usr/local/bin/cleanup-tmp.sh
You will see:
#!/usr/bin/env bash
set -euo pipefail
DIR=${DIR:-/tmp}
DAYS=${DAYS:-3}
find "$DIR" -type f -name "order-*.tmp" -mtime +$DAYS -print
What it means: Print-only first version.
Example 14: Seed old temps
Type this:
sudo touch -d '5 days ago' /tmp/order-a.tmp /tmp/order-b.tmp && ls /tmp/order-*.tmp
You will see:
/tmp/order-a.tmp
/tmp/order-b.tmp
What it means: Older than 3 days.
Example 15: Mode check
Type this:
stat -c '%a' /usr/local/bin/cleanup-tmp.sh
You will see:
755
What it means: Not world-writable.
Step 6: Dry-run the cleanup
Why: Printing first avoids accidents. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: -print is the dry-run. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 16: Dry-run list
Type this:
sudo DIR=/tmp DAYS=3 /usr/local/bin/cleanup-tmp.sh
You will see:
/tmp/order-a.tmp
/tmp/order-b.tmp
What it means: Would delete these.
Example 17: Count candidates
Type this:
sudo DIR=/tmp DAYS=3 /usr/local/bin/cleanup-tmp.sh | wc -l
You will see:
2
What it means: Two files.
Example 18: Fresh file stays
Type this:
sudo touch /tmp/order-fresh.tmp; sudo DIR=/tmp DAYS=3 /usr/local/bin/cleanup-tmp.sh | grep fresh || echo fresh_kept
You will see:
fresh_kept
What it means: mtime today is kept.
4. Automate and verify
Step 7: Delete only after dry-run
Why: Only then we remove. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: -delete removes after review. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 19: Switch to delete
Type this:
printf '%s\n' '#!/usr/bin/env bash' 'set -euo pipefail' 'DIR=${DIR:-/tmp}' 'DAYS=${DAYS:-3}' 'find "$DIR" -type f -name "order-*.tmp" -mtime +$DAYS -print -delete' | sudo tee /usr/local/bin/cleanup-tmp.sh >/dev/null && sudo chmod 755 /usr/local/bin/cleanup-tmp.sh && echo updated
You will see:
updated
What it means: -print -delete shows then removes.
Example 20: Run delete
Type this:
sudo DIR=/tmp DAYS=3 /usr/local/bin/cleanup-tmp.sh; ls /tmp/order-*.tmp 2>/dev/null || echo cleaned
You will see:
/tmp/order-fresh.tmp
cleaned
What it means: Old ones gone; fresh remains.
Example 21: Confirm gone
Type this:
test ! -f /tmp/order-a.tmp && echo a_gone
You will see:
a_gone
What it means: Deleted.
Step 8: Put cleanup on cron
Why: Humans forget; cron does not. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: crontab -e or a file under cron.d. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 22: Install cron
Type this:
printf '%s\n' '30 2 * * * root DIR=/tmp DAYS=3 /usr/local/bin/cleanup-tmp.sh >> /var/log/cleanup-tmp.log 2>&1' | sudo tee /etc/cron.d/cleanup-tmp >/dev/null && cat /etc/cron.d/cleanup-tmp
You will see:
30 2 * * * root DIR=/tmp DAYS=3 /usr/local/bin/cleanup-tmp.sh >> /var/log/cleanup-tmp.log 2>&1
What it means: Daily 02:30.
Example 23: Mode for cron.d
Type this:
sudo chmod 644 /etc/cron.d/cleanup-tmp && stat -c '%a' /etc/cron.d/cleanup-tmp
You will see:
644
What it means: cron.d files must not be executable.
Example 24: List cron.d
Type this:
ls /etc/cron.d/cleanup-tmp
You will see:
/etc/cron.d/cleanup-tmp
What it means: Present.
Step 9: Add a size alert helper
Why: A tiny df check closes the loop. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: df -P shows percent after cleanup. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 25: Helper df line
Type this:
printf '%s\n' 'df -P /var | awk "NR==2{print \$5}"' > /tmp/dfvar.sh; bash /tmp/dfvar.sh
You will see:
58%
What it means: Quick percent.
Example 26: Log a line
Type this:
echo "$(date -Is) cleanup ok pct=$(df -P /var | awk 'NR==2{print $5}')" | sudo tee -a /var/log/cleanup-tmp.log >/dev/null && tail -1 /var/log/cleanup-tmp.log
You will see:
2026-10-28T11:30:00+05:30 cleanup ok pct=58%
What it means: Audit line.
Example 27: grep history
Type this:
sudo grep cleanup /var/log/cleanup-tmp.log | tail -1
You will see:
2026-10-28T11:30:00+05:30 cleanup ok pct=58%
What it means: Readable.
5. Harden and accept
Step 10: Protect script mode
Why: World-writable scripts are banned. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: chmod 755 on the script only. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 28: Script mode
Type this:
stat -c '%a %n' /usr/local/bin/cleanup-tmp.sh
You will see:
755 /usr/local/bin/cleanup-tmp.sh
What it means: Owner execute only extras.
Example 29: Rule mode
Type this:
stat -c '%a %n' /etc/logrotate.d/order-service
You will see:
644 /etc/logrotate.d/order-service
What it means: Fine.
Example 30: No 777
Type this:
find /usr/local/bin/cleanup-tmp.sh /etc/logrotate.d/order-service /etc/cron.d/cleanup-tmp ! -perm 777 | wc -l
You will see:
3
What it means: None are world-writable.
Step 11: Verify after 24 hours
Why: Tomorrow we confirm disk is down. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: Compare df before and after. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 31: df after
Type this:
df -P /var | awk 'NR==2{print $5}'
You will see:
55%
What it means: Down from 62.
Example 32: Rotated files
Type this:
sudo ls /var/log/order-service/
You will see:
app.log
app.log.1
app.log.2.gz
What it means: Rotation kept.
Example 33: Cron present
Type this:
test -f /etc/cron.d/cleanup-tmp && echo cron_ok
You will see:
cron_ok
What it means: Scheduled.
Step 12: Acceptance checklist
Why: Neha signs off when these pass. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: Healthy disk, rotated files, cron present. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 34: logrotate dry
Type this:
sudo logrotate -d /etc/logrotate.d/order-service >/dev/null && echo rotate_ok
You will see:
rotate_ok
What it means: Rule still valid.
Example 35: cleanup dry
Type this:
sudo DIR=/tmp DAYS=3 /usr/local/bin/cleanup-tmp.sh | wc -l
You will see:
0
What it means: Nothing left to clean.
Example 36: Sign-off
Type this:
echo 'Neha: PASS'
You will see:
Neha: PASS
What it means: Done.
Check yourself
Q1. Which tool rotates logs on Linux?
logrotate
Q2. What does find -mtime +3 mean?
Files modified more than 3 days ago.
Q3. Safe first step before deleting?
Dry-run / print the file list.
Q4. Where do drop-in logrotate rules live?
/etc/logrotate.d/
Q5. Why compress rotated logs?
They take far less disk.
Q6. Who wrote the Flipkart fix?
Neha
Friends, you built log rotation and cleanup the company way: logrotate, find -mtime, cron and a dry-run. Did you understand? Let us try it once more. Drop a 100 MB practice log and watch logrotate compress it.
मित्रांनो, तुम्ही company सारखे log rotation आणि cleanup बनवले. Practice log टाकून logrotate compress पहा.
दोस्तों, आपने company जैसा log rotation और cleanup बनाया. Practice log डालकर logrotate compress देखें.
Lab: try at home
- Write /etc/logrotate.d/order-service.
- Force-rotate a practice log.
- Write cleanup-tmp.sh with find -mtime.
- Dry-run the cleanup.
- Install the daily cron.
Recap
- logrotate compresses and keeps N copies.
- find -mtime +3 finds old temp files.
- Dry-run before delete.
- cron runs daily at 02:30.
- Mode 644 for logrotate rules.