Code Summary: MongoDB Server Log Rotation and Retention

Rotating Logs

To rotate logs for a self-managed mongod deployment, use the db.adminCommand() in mongosh:

db.adminCommand( { logRotate : 1 } )

Alternatively, you can issue the SIGUSR1 signal to the mongod process with the following command:

sudo kill -SIGUSR1 $(pidof mongod)

Rotating Logs Using Rename and Reopen

To start mongod with MongoDB’s standard rename log rotation behavior, invoke the daemon with the --logpath argument. Even though rename is not explicitly specified, it’s the default if the --logpath argument is used:

> mongod -v --logpath /var/log/mongodb/server1.log

To start the mongod process with the reopen approach, invoke the daemon with the --logpath, --logRotate, and --logappend command-line arguments:

• --logpath sends all diagnostic logging information to a log file
• --logappend appends new entries to the end of the existing log file
• --logRotate determines the behavior for the logRotate command (rename or reopen)

mongod -v --logpath /var/log/mongodb/server1.log --logRotate reopen --logappend

Automating Log Rotation with the logrotate Service

To automate the rotation of MongoDB logs by using the Linux logrotate service, first make the following changes to the mongod.conf file. Open the file in Vim or another text editor by using the following command:

sudo vim /etc/mongod.conf

In the configuration file, add the following lines to enable the reopen method of log rotation and append new lines to the re-opened file:

...
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log
  logRotate: reopen
...

To leverage the logrotate service in Linux, create a script that provides instructions to logrotate, located in the etc directory for the logrotate service:

sudo vim /etc/logrotate.d/mongod.conf

To configure logrotate to send a SIGUSR1 signal to mongod once per day, or when the file size reaches 10 MB, use the following configuration.

Note: The MongoDB configuration file and the logrotate script have the same filename. The following file should be created in /etc/logrotate.d/ and named mongod.conf.

/var/log/mongodb/mongod.log {
   daily 
   size 
   rotate 10 
   missingok
   compress 
   compresscmd /usr/bin/bzip2 
   uncompresscmd /usr/bin/bunzip2 # command to uncompress the file
   compressoptions -9 # options for the compression utility
   compressext .bz2 # file format of the compressed archive
   delaycompress # wait to compress files until it's an opportune time
   notifempty # don't bother compressing if the log file is empty
   create 640 mongodb mongodb # creates the log  file with specific permissions
   sharedscripts # don't run multiple rotations at once
   postrotate # tell mongod to rotate, remove empty files
       /bin/kill -SIGUSR1 `cat /var/run/mongodb/mongod.pid 2>/dev/null` >/dev/null 2>&1
       find /var/log/mongodb -type f -size 0 -regextype posix-awk -regex "^\/var\/log\/mongodb\/mongod\.log\.[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}-[0-9]{2}-[0-9]{2}$" -execdir rm {} \; >/dev/null 2>&1
   endscript # end of the script
}

With the logrotate file in place, restart the mongod service by using the following command:

sudo systemctl restart mongod

Testing the logrotate Configuration

To test the logrotate configuration, use the tail command on the mongod.log file while issuing a SIGUSR1 signal to the mongod process:

View the mongod.log file in real time by using the following code:

sudo tail -F /var/log/mongodb/mongod.log

Then tell mongod process to rotate the logs:

sudo kill -SIGUSR1 $(pidof mongod)

In the mongod.log file, notice the following line, indicating that the log was reopened. Depending on your distribution of Linux, the language in this line may vary.

tail: /var/log/mongodb/mongod.log: file truncated;