Log rotation, retention and bounded evidence
Log rotation changes the active log or retained segments so diagnostic storage remains bounded, with size and retention controlling available history.
Log rotation limits a continuing stream of diagnostic data by starting or selecting another active segment and retaining earlier segments under a policy.
Rotation determines file boundaries. Retention determines which old segments remain. Neither alone guarantees a fixed number of days of evidence.
A size budget has a rate
In an original model, the active log can reach 50 MB and the system retains five completed 50-MB segments. The maximum uncompressed file budget is about 300 MB: one active segment plus five retained ones.
(1 active + 5 retained) × 50 MB = 300 MB
At 1 MB/minute: about 300 minutes of uniformly produced data
At 10 MB/minute: about 30 minutes
Real segments can be smaller, compressed or constrained by other limits. A sudden diagnostic burst can shorten the retained time window dramatically.
| Policy | What it bounds |
|---|---|
| Maximum segment size | How much one segment can accumulate |
| Retained segment count | Number of older segments kept |
| Maximum age | Age eligibility under that policy |
| Total storage budget | Aggregate retained volume |
Changing a name does not necessarily change an open handle
One rotation mechanism renames the current file and asks the writer to reopen a new one. A process with an existing handle can continue writing to the previously opened object until it follows the required reopen lifecycle.
Other mechanisms copy and truncate or use a managed logging service. These have different timing and consistency behavior. A filename becoming “old” is not universal proof that the writer has stopped using it.
Emby's supported logging lifecycle defines how its own files are created and retained. The systemd journal is another example of a managed system with documented storage and retention controls, rather than the same file-rotation configuration.
Preserve the relevant interval
When investigating a failed operation, establish the event time and which retained segments cover it. A current log can contain only the later successful operation, while the initial failure was in an older segment.
The absence of that older file changes the available evidence. It does not reverse the earlier event. Logging levels determine what was recorded within the surviving interval.