Mistake: logrotate eats the data you were about to analyze

Mistake: logrotate eats the data you were about to analyze

Default rotation discards old logs before you've sampled a full crawl cycle. Sources:

→ logrotate man page — rotate 4 + weekly = only ~4 weeks retained, and create vs copytruncate changes whether in-flight writes are lost.
Takeaway: bump retention, or ship to cold storage before rotation.

→ Nginx / Apache reopen docs — Why copytruncate can drop lines under load if the app doesn't reopen the handle.
Takeaway: prefer signal-based reopen (USR1) over copytruncate for accuracy.

★ Pick of the week — a tiny ship-on-rotate hook — postrotate script that gzips and pushes to object storage.
Takeaway: never analyze from the live file you're still rotating.