Managing Log File Growth with logrotate
A system is running out of disk space on /var. The administrator finds that /var/log/syslog is 4GB. Which of the following is the best course of action to prevent future issues while keeping recent logs?
Quick Answer
The correct answer is to configure logrotate to rotate and compress logs daily. This is the standard Linux utility for managing log file growth, as it automatically archives old logs like /var/log/syslog into compressed files such as syslog.1.gz, keeping only recent entries in the active file and preventing disk space exhaustion on /var without losing historical data. On the LPIC-1 exam, this question tests your understanding of system administration tasks related to log management and disk space monitoring, often appearing in scenarios where /var fills up due to unchecked log accumulation. A common trap is to manually delete logs or disable logging entirely, which violates the requirement to keep recent logs; instead, logrotate’s rotation and compression offer a sustainable, automated solution. Remember the mnemonic “Rotate and Compress to Decompress Disk Stress” to recall that logrotate prevents disk issues while preserving log history.
⚠ Common exam trap
Watch out — candidates often confuse immediate space recovery (truncation/deletion) with sustainable log management, overlooking that logrotate provides automated, policy-driven rotation and compression to prevent recurrence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure logrotate to rotate and compress logs daily.
Logrotate is the standard Linux utility for managing log file growth. By configuring it to rotate and compress logs daily, the administrator can automatically archive old logs (e.g., /var/log/syslog.1.gz) and keep only recent entries in the active file, preventing disk space exhaustion without losing historical data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use 'truncate -s 0 /var/log/syslog' to empty the file.
Why it's wrong here
This is a temporary fix, doesn't prevent future growth.
- ✓
Configure logrotate to rotate and compress logs daily.
Why this is correct
Correct: logrotate manages log sizes.
- ✗
Configure syslog to stop logging.
Why it's wrong here
Not recommended; logs are important.
- ✗
Delete /var/log/syslog and create an empty file.
Why it's wrong here
Deletes all logs, not a good practice.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-1 question from scratch — 527 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on LPIC-1
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. The system administrator sees that /var/log is 93% full and the syslog file is nearly 2 GB. What is the most appropriate immediate action to free up disk space without losing any critical log data?
easy- ✓ A.Run 'logrotate -f /etc/logrotate.conf' to force log rotation.
- B.Increase the size of the /var/log partition using lvextend.
- C.Delete /var/log/syslog and restart the syslog daemon.
- D.Move /var/log/syslog to /tmp and create a symbolic link.
Why A: 'logrotate -f' forces an immediate rotation of all log files as defined in /etc/logrotate.conf, which compresses or archives the current syslog file (e.g., syslog becomes syslog.1) and creates a fresh empty log file. This frees disk space without deleting any data, as the rotated logs remain on disk until the configured retention policy removes them. It is the standard, safe immediate action for a nearly full /var/log partition.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.