rsyslog & logrotate

rsyslog

rsyslog routes messages to files based on facility (auth, cron, kern, mail…) and priority. Rules live in /etc/rsyslog.conf and /etc/rsyslog.d/.

auth,authpriv.*     /var/log/auth.log
*.emerg             :omusrmsg:*

logrotate

Logs grow forever without rotation. logrotate compresses and prunes them on a schedule (run from cron/systemd timer).

# /etc/logrotate.d/nginx
/var/log/nginx/*.log {
    weekly
    rotate 4
    compress
    missingok
    postrotate
        systemctl reload nginx
    endscript
}

Exam tip: rotate 4 + weekly keeps four weeks of logs. logrotate -d <file> does a dry run (debug) without changing anything.