Tired of having to clear up disk space issues due to logs fill up?

Tired of having to search through several gigabyte large files?

Your Nginx environment typically puts its logs in /var/log/nginx/*, but you can configure your logs anywhere using the access_log directive.

http {
log_format compression '$remote_addr - $remote_user [$time_local]' '"$request" $status $body_bytes_sent' '"$http_referer" "$http_user_agent" "$gzip_ratio"';

server {
  gzip on;
  access_log /var/log/nginx/access.log;
  error_log /var/log/nginx/error.log;
  ...
  }
}

Now these logs will write to this location forever. These logs will continue to grow and grow.

$ ls -al
-rw-r--r-- 1 nginx nginx 638962527 Mar 20 11:33 access.log
-rw-r--r-- 1 nginx nginx 98372 Mar 20 10:47 error.log
-rw-r--r-- 1 nginx nginx 3 Feb 14 07:16 nginx.pid
```

Thats HUGE!!!! 😱 Imagine having to review a log that big!!!! Forget it!

How about we regularly rotate the logs so we have smaller files to review? Here is a simple way to rotate your logs without any external resource like logrotate or cron based scripts.


Time Based Rotation

As it turns out, it’s not only possible but also pretty easy to achieve, since Nginx introduced the possibility to use variables in access_log directives (added in 0.7.4), and the $time_iso8601 variable providing time in ISO 8601 format (added in 0.9.6).

ℹ️ Please note, that it’s not possible to embed variables in error_log directives, as any potential error would not be able to be logged if the file cannot be written.

Here is an example showing $time_iso8601 format :

2014-05-04T18:12:02+02:00

All there is to do is use an “if” block to split required data using a regular expression and set time variables.

For splitting logs by day, one would use the following snippet in the server block :

if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})") {
    set $year $1;
    set $month $2;
    set $day $3;
}

access_log /var/log/nginx/access_$year-$month-$day.log;

Give it a shot, it’ll make your life much easier having your logs chopped by date. You may still want to delete logs older than a particular date to save disk space.

Enjoy. 🤘