iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To remove web-server logs on a 24-hour cycle, configure two separate controls: rotate the active log into a new file every day, then expire older rotated files with an explicit age or count policy. Apache can rotate with rotatelogs, Linux and NGINX commonly use scheduled logrotate rules, and IIS exposes a daily period setting. Rotation alone does not guarantee deletion of older files.
What “delete every 24 hours” should mean
A web server normally keeps an open file handle for its access and error logs. If you simply delete that pathname while the process still has the file open, the server may continue writing to the unlinked inode, disk space may not be reclaimed as expected, and the next diagnostic step becomes difficult. A safe policy therefore has two stages:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
- Rotation: close, rename, or replace the current file and begin writing to a fresh file at a 24-hour boundary.
- Retention: remove or archive files older than your approved age or beyond your approved count.
These controls solve different problems. A daily interval creates one file per day, but many systems will retain every rotated file until a separate retention rule removes them. Conversely, a cleanup job that deletes old names without making the daemon reopen its log can leave the process writing to an invisible file.
Decide the policy before changing configuration
Write down the operational rule in terms an administrator can test. For example, “create a new file daily at the server’s local midnight and retain 14 completed files” is a count policy, while “retain 30 days of compressed logs” is an age policy. Neither is universally correct. Security investigations, incident-response procedures, privacy commitments, contractual obligations, and local law can all change the required period.
#1 Best Overall
- Identify every access and error-log path, including virtual hosts, application pools, containers, and reverse-proxy instances.
- Record which operating-system account owns each file and which account runs the scheduler or web service.
- Choose whether rotated files should be compressed, and confirm that investigators can still read the chosen format.
- Choose a time zone and document it. A “day” follows the host or service time configuration unless you deliberately standardize it.
- Apply the same policy to every web node. A rule on one machine does not rotate logs on the rest of a load-balanced fleet.
Apache HTTP Server: rotate with rotatelogs
Configure a 24-hour interval
Apache documents piped logging through rotatelogs. The interval is expressed in seconds, so 86,400 seconds represents 24 hours. A typical access-log directive is:
CustomLog "|/usr/local/apache/bin/rotatelogs /var/log/httpd/access_log 86400" combined
Configure the error log through the equivalent directive:
ErrorLog "|/usr/local/apache/bin/rotatelogs /var/log/httpd/error_log 86400"
Use the executable path installed on your host and a directory writable by the account under which Apache starts its logging process. The final argument, combined, selects the access-log format in the first example; keep the format required by your analytics or incident-response tooling.
Use date-based names when operators need calendar clarity
Apache also documents date-formatted filenames for rotatelogs. A date in each filename makes it easier to identify the day that a file covers, but the exact pattern and boundary still depend on the service’s time settings. Decide whether your retention procedure will identify files by age, by filename date, or by a fixed count, and test the result across a daylight-saving transition if the host observes one.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Separate rotation from deletion
The 86,400-second interval tells Apache when to start a new file; it is not, by itself, a promise that every older file will be deleted. Add an explicit retention mechanism, such as the host’s scheduled log-rotation service, with an age or count that matches your policy. If you use an external tool to rename or move Apache’s files, the daemon must be told to reopen them. Apache’s documentation warns that httpd continues writing to the old file handle until it receives the appropriate signal.
Reopen safely after an external move
Use the graceful reload or reopen procedure provided by your Apache installation after an external rotation. A graceful operation lets existing requests finish while workers begin using the new file. Verify the procedure in your service manager, then check that the new pathname receives entries; do not assume that a successful rename means Apache has switched handles.
Linux and NGINX: use the scheduled logrotate service
How the daily rule works
On Linux, logrotate is commonly launched by a distribution timer or cron job. NGINX documentation shows the relevant controls, including copytruncate, create, and rotate 20. The rotate value is a count: after that many rotations, older files are removed. Adapt the rule to a daily schedule and to the number of files your policy permits.
A representative rule has this shape; replace the paths, owner, group, mode, and reload action with the values used by your distribution:
Recommended Free Tools
Rank #3
- Upgraded Two Zipper Pockets: Forvencer server books feature two secure zipper pockets for better organization of coins, cash, and receipts, ensuring that everything you collect has a safe and secure place
- Smart Storage & Quick Access: Designed with 8 multi-functional compartments, the right side includes a guest receipt pad, while the left has a money pocket, ticket pocket, and credit card slot. Two small clear pockets store bills, receipts, and other visible items. A stitched pen loop ensures you always have your favorite pen ready
- High-quality & Easy to Clean: Crafted from high-quality PU leather with heavy-duty stitching, this server book is built to last. It resists tears, scratches, and its waterproof surface makes cleaning easy with just a damp cloth or a non-chlorine sanitizer
- Perfect Fit for Your Apron: Measuring 5” x 8”, this compact organizer is slightly smaller than other models, making it ideal for bending or sitting while carrying in your server apron. It holds everything a waitress needs—a place for everything
- What's Included: This server organizer comes with multiple open and zippered pockets to store money, receipts, tips, etc. Clear sleeves are perfect for keeping menus or special lists while serving. Available in a variety of colors, allowing you to express yourself even when in uniform
/var/log/nginx/access.log /var/log/nginx/error.log {
daily
rotate 14
compress
missingok
notifempty
create 0640 root adm
postrotate
# invoke the service-specific NGINX reopen or reload action here
endscript
}daily requests one rotation per day. rotate 14 keeps 14 rotated files before the oldest is removed; it is not the same as retaining exactly 14 calendar days when a scheduler has been down. compress reduces storage after rotation. create makes a new file with the specified permissions, so the daemon must reopen the path. The postrotate block is where the host’s supported NGINX reopen action belongs.
Choose between create and copytruncate
With create, logrotate renames the old file, creates a new one, and asks NGINX to reopen it. This avoids copying the entire active file, but a missing or ineffective reopen action can leave NGINX writing to the renamed file. With copytruncate, logrotate copies the active contents to a rotated file and truncates the original pathname in place. That avoids a daemon reload, but entries written during the copy-and-truncate window can be duplicated or lost. Use one method deliberately, not both, and validate it under real traffic.
Make sure the scheduler actually runs
A correct rule has no effect if the timer or cron task is disabled, runs at a different time zone, or lacks permission to read and create the files. Confirm the distribution’s scheduled job, inspect its logs, and check the ownership and mode of both the active and rotated files. On a multi-node deployment, install and test the policy on every node rather than relying on a shared configuration file that may not be deployed everywhere.
IIS: set the log period to Daily
Use the native period setting
Microsoft’s IIS <logFile> settings expose a period attribute. Daily creates a new log file each day and is the documented default period. Other values are Hourly, Weekly, Monthly, and MaxSize.
Free tools Windows power users keep installed
One-click scans. No signup required.
At the site-default level, the configuration has the following form:
<system.applicationHost>
<sites>
<siteDefaults>
<logFile period='Daily' />
</siteDefaults>
</sites>
</system.applicationHost>Apply the setting at the scope that matches your deployment: site defaults for a common baseline, or an individual site when one application needs a different cadence. Existing higher- or lower-level settings can override a default, so inspect the effective configuration for the site you are troubleshooting.
Use size rollover when daily files are still too large
IIS also documents truncateSize for size-based rollover. A daily period limits the calendar span of a file; a truncate-size rule limits the amount of data in a file. If traffic spikes make a day’s file impractical to process, combine an appropriate size threshold with a retention procedure that still meets your operational and legal requirements.
Do not confuse new-file creation with retention
The IIS period controls when a new file is created. It does not state how long completed files remain on disk. Set and monitor a separate cleanup or archival policy, and ensure the account performing that work can access the IIS log directory without weakening the permissions needed by the web service.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Retention: age versus count
| Policy style | What it guarantees | Strength | Risk to check |
|---|---|---|---|
| Age-based | Files older than a stated number of days are removed or archived. | Maps directly to a “keep 30 days” requirement. | A missed scheduler run can leave files older than the target until the next successful run; filename timestamps and time zones must be reliable. |
| Count-based | A stated number of completed rotations is retained. | Predictable maximum number of files and simple disk planning. | It is not a fixed number of calendar days when traffic, outages, or rotation frequency changes. |
| Archive-then-delete | Older files move to controlled storage before local deletion. | Preserves investigation history while limiting web-node disk use. | Requires access controls, transfer monitoring, encryption decisions, and a second retention schedule. |
Document the owner who approves the retention value. A web administrator can implement the mechanism, but the acceptable period belongs to the organization’s security, privacy, legal, and incident-response policy. There is no single legally correct number for every jurisdiction or industry.
Verification checklist after deployment
- Record the active access and error-log paths before changing them.
- Apply the native daily rotation setting or the operating system rule.
- Set the retention count or age explicitly; never rely on a default you have not verified.
- Check the scheduler’s next run time and the time zone used by the host.
- Generate a harmless test request so the active file contains a fresh entry.
- Run or wait for one rotation, then confirm that a new active file is receiving entries.
- Inspect the rotated file’s owner, group, mode, timestamp, and compression state.
- Confirm that the retention rule removes or archives only files outside the approved boundary.
- Repeat the check on every web node and for every virtual host or application pool that writes separate logs.
For Apache, pay particular attention to the reopen step after an external move. For NGINX, verify whether your rule uses create with a reopen action or copytruncate. For IIS, inspect the effective site configuration rather than assuming that a site-default value overrides a local setting.
Common failure modes and fixes
Files rotate but never disappear
Rotation and deletion are separate controls. Add or correct the age or count rule, then check that the cleanup scheduler runs with permission to remove the rotated files. If a policy intentionally archives files, verify the archive destination before expecting local deletion.
The server keeps writing to yesterday’s file
This indicates that the process retained its old file handle. Use the server’s supported graceful reopen after an external rename, or select an in-place method such as copytruncate where its trade-offs are acceptable. Confirm by watching which pathname receives a newly generated request.
A new file exists but remains empty
Check ownership and mode on the newly created file, the account running the daemon, and the post-rotation reopen action. A rotation job can succeed while the daemon lacks permission to open the replacement.
Two files cover the same period
Look for overlapping mechanisms: for example, Apache’s piped rotatelogs together with a second external rule acting on the same path. Choose one component to perform the actual rotation and use the other only for a clearly defined retention or archival task.
Deletion occurs at an unexpected hour
Review the scheduler’s time zone, the server’s clock, daylight-saving behavior, and whether the service uses UTC while the operating system uses local time. A “daily” setting is a 24-hour or calendar boundary according to that component’s time configuration, not necessarily your office time.
Only one node is being cleaned
Check configuration management, timer status, permissions, and log paths on every node. Centralized load balancing does not centralize local files, and a shared policy document does not prove that each machine loaded it.
Which mechanism should you choose?
| Server | Native daily rotation control | Retention control | Reopen consideration | Filename and time behavior |
|---|---|---|---|---|
| Apache HTTP Server | rotatelogs with an 86,400-second interval; date-formatted names are also documented. |
Configure a separate age- or count-based policy. | Required when an external tool moves files; httpd can keep the old handle until signaled. | Validate the date pattern and service time zone used by the deployment. |
| NGINX on Linux | Scheduled logrotate rule using daily. |
rotate N provides a count; add other policy controls as required. |
create needs a daemon reopen; copytruncate avoids reload but has a copy window. |
Check scheduler time zone and the names generated by the host rule. |
| IIS | <logFile period='Daily' />; other periods include hourly, weekly, monthly, and max-size. |
Implement a separate cleanup or archival schedule. | The native period creates the next file; verify how your chosen cleanup process handles completed files. | Inspect effective IIS configuration and the server’s clock. |
Operational safeguards
- Protect evidence: If logs may be needed for an investigation, archive them under controlled access before local deletion.
- Protect privacy: Longer retention increases exposure of client addresses, identifiers, and request data. Keep only what the approved policy requires.
- Protect availability: Monitor free space and alert when rotation, compression, archival, or deletion fails.
- Protect consistency: Version-control the configuration and deploy the same tested rule to all web nodes.
- Protect recoverability: Keep a documented rollback procedure, including the previous rotation rule and the service reopen command used by your platform.
The practical answer is therefore not a single delete command. Configure a daily rotation native to the server, define retention independently, make the daemon reopen the replacement file when required, and verify the scheduler, permissions, time zone, and resulting file contents on every host.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
