cloudthinker-ai Log Rotation and Cleanup Runbook Skill
Execute log rotation on {{ target_host }} for {{ log_path }}. Retention: {{ retention_days }} days | Disk threshold: {{ disk_threshold }}
Workflow
Phase 1 — Disk Usage Assessment
DISK USAGE ASSESSMENT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
HOST: {{ target_host }}
CURRENT DISK STATE
Filesystem: ___
Total size: ___
Used: ___ (___%)
Available: ___
Threshold: {{ disk_threshold }}
Status: [OK / WARNING / CRITICAL]
LOG DIRECTORY ANALYSIS ({{ log_path }})
Total log size: ___
Number of log files: ___
Oldest log file: ___ (date: ___)
Largest log file: ___ (size: ___)
Daily log growth rate: ___ MB/day
Estimated days until disk full: ___
TOP SPACE CONSUMERS
1. ___ — ___ GB
2. ___ — ___ GB
3. ___ — ___ GB
4. ___ — ___ GB
5. ___ — ___ GB
Phase 2 — Rotation Configuration Review
ROTATION CONFIGURATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CURRENT LOGROTATE CONFIG (if exists):
Config file: /etc/logrotate.d/___
Rotation frequency: [daily / weekly / monthly]
Retention count: ___ rotated files
Compression: [enabled / disabled]
Max size trigger: ___
Post-rotate script: [yes / no]
RECOMMENDED CONFIGURATION:
Path: {{ log_path }}*.log
Rotation: daily
Retention: {{ retention_days }} days
Compression: enabled (gzip/zstd)
Max size: ___ MB (rotate if exceeded between scheduled runs)
Copytruncate: [yes — if app cannot reopen log files]
Missingok: yes
Notifempty: yes
[ ] Review current logrotate configuration
[ ] Identify logs NOT covered by logrotate
[ ] Check for application-level log rotation (log4j, logback, etc.)
[ ] Verify log rotation does not conflict with log shipping (fluentd, filebeat)
Phase 3 — Emergency Cleanup (if disk critical)
EMERGENCY CLEANUP (if disk > {{ disk_threshold }})
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SAFE TO DELETE:
[ ] Compressed rotated logs older than {{ retention_days }} days
[ ] Orphaned .tmp log files
[ ] Core dumps (if not needed for investigation)
[ ] Package manager cache (apt/yum cache)
PROCEED WITH CAUTION:
[ ] Truncate active log files (> 1GB) if application supports it
- Use truncate -s 0 (NOT rm) for active log files
- Verify application continues logging after truncation
[ ] Compress uncompressed rotated logs
SPACE RECOVERED: ___ GB
Disk usage after cleanup: ___% (target: < {{ disk_threshold }})
Phase 4 — Apply Rotation Policy
APPLY ROTATION POLICY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Create or update logrotate configuration file
[ ] Test configuration: logrotate -d /etc/logrotate.d/___
[ ] Execute manual rotation: logrotate -f /etc/logrotate.d/___
[ ] Verify rotation executed:
- New rotated file created: ___
- Compressed file created: ___
- Old files beyond retention deleted: ___
[ ] Verify application still writing to log file
[ ] Verify log shipper (if any) handling rotation correctly
Phase 5 — Archive Configuration
ARCHIVE CONFIGURATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
LONG-TERM ARCHIVAL (if required):
[ ] Archive destination: [S3 / GCS / Azure Blob / NFS]
[ ] Archive bucket/path: ___
[ ] Lifecycle policy: move to cold storage after ___ days
[ ] Delete from archive after ___ days
[ ] Encryption: [enabled / disabled]
ARCHIVE PROCESS:
[ ] Compress logs before archival
[ ] Upload to archive destination
[ ] Verify archive integrity (checksum)
[ ] Record archived date range: ___ to ___
[ ] Remove local copies after archive confirmation
Phase 6 — Validation and Monitoring
VALIDATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Disk usage after rotation: ___% (target: < {{ disk_threshold }})
[ ] Logrotate cron job scheduled and active
[ ] Next scheduled rotation: ___
[ ] Application logging uninterrupted
[ ] Log shipping pipeline healthy (no gaps in ingestion)
[ ] Monitoring alert set for disk usage > {{ disk_threshold }}
[ ] Monitoring alert set for log growth rate anomalies
[ ] Document rotation policy for this host/service
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Produce a log rotation report with:
- Disk assessment before and after cleanup
- Space recovered from immediate cleanup actions
- Rotation policy applied with configuration details
- Archive status for long-term retention
- Validation confirming healthy logging and disk state
- Monitoring alerts configured for ongoing protection