Hosting Operations
Read-onlyDry-Run Logrotate Before Touching Logs
You need to understand what logrotate would do without compressing, renaming, or truncating real logs.
Command
logrotate -d /etc/logrotate.conf 2>&1 | sed -n '/rotating pattern/p;/considering log/p;/error:/p'Before you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not use -f unless you intentionally want to force rotation; this lesson is debug-only.
Expected output
rotating pattern and considering log lines from logrotate debug output.
System impact
Read-only. Nothing changes. The -d flag runs logrotate in debug mode and the pipe extracts useful decision lines.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use before changing logrotate rules or when logs are growing and you need to see whether policies match them.
When not to use it
Do not use -f unless you intentionally want to force rotation; this lesson is debug-only.
Dry-run limitation
logrotate -d prints what it would consider, but it is not proof that deleting or vacuuming logs is safe. Capture incident logs first.
logrotate -d /etc/logrotate.confjournalctl --disk-usage
next steps
Related commands
Find Logs Missing Logrotate Coverage
The biggest log risk is often the file no policy mentions.
find /var/log -type f -name '*.log' -printf '%p\n' | while read -r log; do grep -Rqs -- "$log" /etc/logrotate.conf /etc/logrotate.d || grep -Rqs -- "$(dirname "$log")/[*].log" /etc/logrotate.conf /etc/logrotate.d || printf '%s\n' "$log"; done
Count Request IDs in Error Lines
Repeated request IDs can connect separate error lines to one failing path.
grep -Ei 'error|timeout|fatal|exception' /var/log/app/app.log | awk '{for (i=1;i<=NF;i++) if ($i ~ /^request_id=/) print $i}' | sort | uniq -c | sort -nr
Count App Errors by Minute
A minute-by-minute count shows whether an incident is a spike or a drip.
awk 'tolower($0) ~ /(error|fatal|timeout|exception)/ {minute=substr($1,1,16); count[minute]++} END {for (m in count) print count[m], m}' /var/log/app/app.log | sort -nr
Scan Every CI Log for Error Lines
One grep pass can turn a log pile into a failure list.
grep -RInE 'error|failed|failure|exception|traceback' artifacts logs | head -50
Review Log Files Before Cleanup
Before truncating logs, prove which log files are large and how old they are.
find /var/log -xdev -type f -printf '%10s %TY-%Tm-%Td %p\n' 2>/dev/null | sort -nr | head -50
next diagnostic step
Where to go from this command
- Journal logs too large hub Use when log retention and disk pressure overlap.
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.