---
checkId: check.logs.rotation.configured
plugin: stellaops.doctor.observability
severity: warn
tags: [observability, logs]
---
# Log Rotation

## What It Checks
Verifies that log rotation is configured to prevent disk exhaustion. The check:

- Looks for application-level rotation via `Logging:RollingPolicy` configuration.
- Checks for Serilog rolling configuration at `Serilog:WriteTo:0:Args:rollingInterval`.
- On Linux, checks for system-level logrotate at `/etc/logrotate.d/stellaops`.
- Scans log files in the log directory and flags any file exceeding 100MB.
- Warns if rotation is not configured and large log files exist or total log size exceeds 200MB.
- Reports info if rotation is not configured but logs are still small.

## Why It Matters
Without log rotation, log files grow unbounded until they exhaust disk space. Disk exhaustion causes cascading failures across all services. Even before exhaustion, very large log files are slow to search and analyze during incident response.

## Common Causes
- Log rotation not configured in application settings
- logrotate not installed or stellaops config missing from `/etc/logrotate.d/`
- Application-level rotation disabled
- Rotation threshold set too high
- Very high log volume overwhelming rotation schedule

## How to Fix

### Docker Compose
Set application-level log rotation:

```yaml
environment:
  Logging__RollingPolicy: "Size"
  Serilog__WriteTo__0__Args__rollingInterval: "Day"
  Serilog__WriteTo__0__Args__fileSizeLimitBytes: "104857600"  # 100MB
```

### Bare Metal / systemd
Option 1 -- Application-level rotation in `appsettings.json`:
```json
{
  "Logging": {
    "RollingPolicy": "Size"
  }
}
```

Option 2 -- System-level logrotate:
```bash
sudo cp /usr/share/stellaops/logrotate.conf /etc/logrotate.d/stellaops

# Or create manually:
cat <<EOF | sudo tee /etc/logrotate.d/stellaops
/var/log/stellaops/*.log {
    daily
    rotate 14
    compress
    missingok
    notifempty
    maxsize 100M
}
EOF
```

### Kubernetes / Helm
```yaml
logging:
  rollingPolicy: "Size"
  maxFileSizeMB: 100
  retainFiles: 14
```

## Verification
```
stella doctor run --check check.logs.rotation.configured
```

## Related Checks
- `check.logs.directory.writable` — verifies log directory exists and is writable
- `check.storage.diskspace` — verifies sufficient disk space is available