Log Rotation
Definition
The scheduled process of closing the current log file, compressing it, renaming it with a date or sequence suffix, and opening a new file. On Linux systems, logrotate manages this. Rotation schedules define how long historical logs are retained locally, which directly affects how far back an investigation can reach without a centralised archive.
- Process
- Close, compress, rename, then reopen the log file
- Trigger
- A schedule or a size threshold
- Linux tool
- logrotate
- Investigative impact
- Limits how far back local logs are retained
Common questions
Why does log rotation matter to an investigator building a timeline?+
The rotation schedule determines how far back local logs still exist before older entries are deleted, compressed, or moved off, which can limit what evidence remains available on the host itself.
What should an investigator check before relying on local logs alone?+
Whether a centralised log archive or SIEM retains history beyond the local rotation window, since the local copies may already have been rotated out and deleted.
Related terms
- Binary Log (Database)
- A database engine's sequential record of all committed data modification statements, used primarily for replication and point-in-time recovery. In MySQL and MariaDB,...
- Combined Log Format
- An extension of the Common Log Format used as the default by Apache HTTP Server and widely adopted by Nginx. Adds referrer...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- SIEM
- Security Information and Event Management. A platform that ingests log streams from multiple sources, normalises them to a common schema, and applies...
- Syslog (RFC 5424)
- A standard protocol and message format for transmitting log data from Unix-like systems and network devices to a centralised collector. Each message...