Logrotate defaults that make sense on a 20 GB disk

A friend asked why his tiny VPS had run out of disk. The answer, as usual: logs. Not because anything was wrong — nothing was — but because the stock rotation policy keeps 4 weeks of rotated logs plus whatever journald decides to hold, and on a 20 GB root filesystem that quietly adds up.

The three knobs that matter

• rotate count: drop nginx access logs from the default 14 to 7. A week's history is plenty to notice a traffic spike; if you need longer trends, that data belongs off the box anyway.
• size over time: prefer size 50M (or maxsize) over weekly so a noisy week can't balloon past what you budgeted.
• compress + delaycompress: already defaults on Debian, but verify — one uncompressed month of access log is the classic "where did 3 GB go".

/var/log/nginx/*.log {
    daily
    rotate 7
    maxsize 50M
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
        invoke-rc.d nginx rotate >/dev/null 2>&1
    endscript
}

Don't forget journald

Logrotate only handles files under /var/log; journald keeps its own binary journals with separate limits. The one line I set on every small box, in /etc/systemd/journald.conf:

SystemMaxUse=200M

Then systemctl restart systemd-journald. Between that and the rotate policy above, logs stay under half a gigabyte forever — which is exactly the amount of disk a blog's logs deserve.

The actual lesson

Small-disk machines don't die from big mistakes, they die from defaults sized for servers ten times larger. Audit the defaults once, write them down, and the problem never comes back.