| name | runbook-log-rotation |
| enabled | true |
| description | Use when performing runbook log rotation — log rotation and cleanup procedure
covering disk usage check, rotation configuration, archival, and cleanup. Use
when disk usage is high due to logs, configuring new log rotation policies, or
performing periodic log maintenance.
|
| required_connections | [] |
| config_fields | [{"key":"target_host","label":"Target Host / Service","required":true,"placeholder":"e.g., prod-web-01, api-service pods"},{"key":"log_path","label":"Log Path(s)","required":true,"placeholder":"e.g., /var/log/app/, /data/logs/nginx/"},{"key":"retention_days","label":"Retention Period (days)","required":true,"placeholder":"e.g., 30, 90"},{"key":"disk_threshold","label":"Disk Alert Threshold","required":false,"placeholder":"e.g., 85%"}] |
| features | ["RUNBOOK","INFRASTRUCTURE"] |
Log Rotation and Cleanup Runbook Skill
Execute log rotation on {{ target_host }} for {{ log_path }}.
Retention: {{ retention_days }} days | Disk threshold: {{ disk_threshold }}
Workflow
Phase 1 — Disk Usage Assessment
DISK USAGE ASSESSMENT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
HOST: {{ target_host }}
CURRENT DISK STATE
Filesystem: ___
Total size: ___
Used: ___ (___%)
Available: ___
Threshold: {{ disk_threshold }}
Status: [OK / WARNING / CRITICAL]
LOG DIRECTORY ANALYSIS ({{ log_path }})
Total log size: ___
Number of log files: ___
Oldest log file: ___ (date: ___)
Largest log file: ___ (size: ___)
Daily log growth rate: ___ MB/day
Estimated days until disk full: ___
TOP SPACE CONSUMERS
1. ___ — ___ GB
2. ___ — ___ GB
3. ___ — ___ GB
4. ___ — ___ GB
5. ___ — ___ GB
Phase 2 — Rotation Configuration Review
ROTATION CONFIGURATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CURRENT LOGROTATE CONFIG (if exists):
Config file: /etc/logrotate.d/___
Rotation frequency: [daily / weekly / monthly]
Retention count: ___ rotated files
Compression: [enabled / disabled]
Max size trigger: ___
Post-rotate script: [yes / no]
RECOMMENDED CONFIGURATION:
Path: {{ log_path }}*.log
Rotation: daily
Retention: {{ retention_days }} days
Compression: enabled (gzip/zstd)
Max size: ___ MB (rotate if exceeded between scheduled runs)
Copytruncate: [yes — if app cannot reopen log files]
Missingok: yes
Notifempty: yes
[ ] Review current logrotate configuration
[ ] Identify logs NOT covered by logrotate
[ ] Check for application-level log rotation (log4j, logback, etc.)
[ ] Verify log rotation does not conflict with log shipping (fluentd, filebeat)
Phase 3 — Emergency Cleanup (if disk critical)
EMERGENCY CLEANUP (if disk > {{ disk_threshold }})
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SAFE TO DELETE:
[ ] Compressed rotated logs older than {{ retention_days }} days
[ ] Orphaned .tmp log files
[ ] Core dumps (if not needed for investigation)
[ ] Package manager cache (apt/yum cache)
PROCEED WITH CAUTION:
[ ] Truncate active log files (> 1GB) if application supports it
- Use truncate -s 0 (NOT rm) for active log files
- Verify application continues logging after truncation
[ ] Compress uncompressed rotated logs
SPACE RECOVERED: ___ GB
Disk usage after cleanup: ___% (target: < {{ disk_threshold }})
Phase 4 — Apply Rotation Policy
APPLY ROTATION POLICY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Create or update logrotate configuration file
[ ] Test configuration: logrotate -d /etc/logrotate.d/___
[ ] Execute manual rotation: logrotate -f /etc/logrotate.d/___
[ ] Verify rotation executed:
- New rotated file created: ___
- Compressed file created: ___
- Old files beyond retention deleted: ___
[ ] Verify application still writing to log file
[ ] Verify log shipper (if any) handling rotation correctly
Phase 5 — Archive Configuration
ARCHIVE CONFIGURATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
LONG-TERM ARCHIVAL (if required):
[ ] Archive destination: [S3 / GCS / Azure Blob / NFS]
[ ] Archive bucket/path: ___
[ ] Lifecycle policy: move to cold storage after ___ days
[ ] Delete from archive after ___ days
[ ] Encryption: [enabled / disabled]
ARCHIVE PROCESS:
[ ] Compress logs before archival
[ ] Upload to archive destination
[ ] Verify archive integrity (checksum)
[ ] Record archived date range: ___ to ___
[ ] Remove local copies after archive confirmation
Phase 6 — Validation and Monitoring
VALIDATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Disk usage after rotation: ___% (target: < {{ disk_threshold }})
[ ] Logrotate cron job scheduled and active
[ ] Next scheduled rotation: ___
[ ] Application logging uninterrupted
[ ] Log shipping pipeline healthy (no gaps in ingestion)
[ ] Monitoring alert set for disk usage > {{ disk_threshold }}
[ ] Monitoring alert set for log growth rate anomalies
[ ] Document rotation policy for this host/service
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Produce a log rotation report with:
- Disk assessment before and after cleanup
- Space recovered from immediate cleanup actions
- Rotation policy applied with configuration details
- Archive status for long-term retention
- Validation confirming healthy logging and disk state
- Monitoring alerts configured for ongoing protection
