Log rotation is not a server-wide setting. Each service ships its own rule, so anything installed by hand - or configured to write somewhere unusual - has no rotation at all and grows until the disk is full.
Find the one that is growing
du -h /var/log --max-depth=2 | sort -h | tail -15\nls -lhS /var/log/*.log | head
Rotate it
# /etc/logrotate.d/mysite
/var/www/site/storage/logs/*.log {
daily
rotate 14
compress
delaycompress
missingok
notifempty
create 0640 www-data www-data
}
Fourteen days compressed is a good default: enough to investigate last week, small enough to forget about.
logrotate -d /etc/logrotate.d/mysite # dry run, prints what it would do
A log that fills in hours
That is not a rotation problem. One repeating warning on every request writes gigabytes in a day, and rotating it just deletes the evidence faster.
sort /var/log/nginx/error.log | uniq -c | sort -rn | head -5
The top line is nearly always the whole problem: one missing file requested a million times, or one PHP notice on every page.
Freeing space by deleting a log a service is writing to does not return the space - the process keeps the handle. Truncate it:
: > /var/log/big.logRotate by size as well as by day for anything that can spike:
size 100M alongside daily catches a runaway before the disk does.