Operations5 min read
Logs worth keeping, and logs worth deleting
Most log output is noise generated at volume. What to keep, how long to keep it, and how to make sure the useful line is still there when you need it.
Logs are only useful if the interesting line is still present and findable. A server writing a gigabyte a day of routine chatter fails both tests: the disk fills, rotation deletes the old file, and the one warning from three days ago goes with it.
Keep
- Anything at warning level or above, for as long as you can afford.
- Start-up output, which records what version and which plugins were actually loaded.
- Crash reports, in full, including the ones you think you understand.
- Administrative actions - bans, kicks, permission changes - because those get disputed.
Delete
Per-request access logs older than a week, debug output left on after debugging, and anything printed once per tick. That last category is not logging, it is a performance problem that happens to write to a file.