Best practices for web server log archiving (Linux + Nginx)

Question

I want to preserve/archive all of my web server logs, and not have any of them be deleted by logrotate. What would a recommended approach be for this? This is a Linux box, running Nginx. Thanks in advance.

(I would prefer to use cronolog, but it appears to not go well with Nginx because of the way Nginx handles logging.)

Answer 1

Do it with logrotate, just tell it what you want...

/var/log/nginx/*.log {
    daily
    dateext
    missingok
    rotate 7305 # 2 decades
    olddir /var/log/nginx/old
    compress
    delaycompress
    notifempty
    create 644 nginx root
    sharedscripts
    postrotate
      if [ -f /var/run/nginx.pid ]; then
        kill -USR1 `cat /var/run/nginx.pid`
      fi
    endscript
}

I don't use nginx, so I used an example I found for the postrotate... If you have a logrotate script already, start with modifying that.

Key parts:

• "daily" means every day. You could do weekly or size-based, but that doesn't interact as prettily with "dateext".
• "dateext" means it'll give the rotated logfiles a name based on the date instead of a simple number; that way it doesn't have to rename every log file every day and you can tell the date of a logfile from the name of the file
• "rotate 36525" -- with leap years there's an average of 365.25 days per year, so this is a full century. Keep more or less... logrotate really prefers to have some sort of retirement, but you can set it ridiculously high.
• "olddir" has to be on the same filesystem, but that'll keep the logs in a separate dir so you can figure out what's going on
• "delaycompress" and "create" help make sure it works with software that doesn't want to work with it