Auto-Delete Web Server Logs Every 24 Hours

Updated 7 November 2026 · Standard formula, shown below

This guide shows you how to automatically delete web server logs every 24 hours using a cron job on Linux. You’ll set up a simple script that removes log files older than a specified age, then schedule it to run daily. This keeps your disk space from filling up without manual effort.

What You’ll Need

Access to a Linux server (Ubuntu, Debian, CentOS, etc.)
Root or sudo privileges to edit crontab and create scripts
Basic familiarity with the command line
Knowing where your web server stores logs (common paths: /var/log/nginx/, /var/log/apache2/, /var/log/httpd/)

Step-by-Step

Decide which logs to delete. Identify the exact directory and file pattern. For example, Nginx logs are typically in /var/log/nginx/ with files like access.log and error.log. You may also have rotated logs like access.log.1, access.log.2.gz, etc.
Create a cleanup script. Use a text editor to create a new file, e.g., /usr/local/bin/cleanup-logs.sh. The script will use the find command to delete files older than a certain number of days. Here’s a basic script that deletes all files in the log directory modified more than 7 days ago:
```
#!/bin/bash
LOG_DIR="/var/log/nginx"
find "$LOG_DIR" -type f -mtime +7 -delete
```
Adjust LOG_DIR and +7 to match your needs. The +7 means files older than 7 days. If you want to delete files older than 24 hours, use -mmin +1440 (1440 minutes = 24 hours) instead of -mtime +1 (which means older than 1 day, but could be 25-48 hours depending on exact time).
Make the script executable. Run chmod +x /usr/local/bin/cleanup-logs.sh.
Test the script manually. Run sudo /usr/local/bin/cleanup-logs.sh to ensure it works without errors. Check that it deletes the intended files. Be careful—this is irreversible.
Open the crontab. Run sudo crontab -e to edit the root user’s cron jobs. (Using root ensures you have permission to delete log files owned by the web server.)
Add a cron entry. Insert a line that runs the script every 24 hours. For example, to run it daily at 3:00 AM:
```
0 3 * * * /usr/local/bin/cleanup-logs.sh
```
The five fields are: minute (0), hour (3), day of month (*), month (*), day of week (*). Save the file. The cron daemon will pick up the change automatically.
Verify the cron job is active. Run crontab -l to list the scheduled jobs. You should see your entry.
Optional: Log the script’s output. To capture errors, redirect output in the cron line: 0 3 * * * /usr/local/bin/cleanup-logs.sh >> /var/log/cleanup-logs.log 2>&1. This appends any output to a log file.

Common Mistakes

Deleting active log files. If you delete the current access.log that the web server is writing to, the server may continue writing to the deleted inode, causing disk space not to be freed until the process restarts. Always exclude the active log file by using a pattern like access.log.* or use -name "*.log.*" to target rotated logs only.
Wrong time unit. Using -mtime +1 means files modified more than 24 hours ago, but because find rounds up to whole days, a file modified 25 hours ago is considered 1 day old, and a file modified 23 hours ago is not. If you need exactly 24 hours, use -mmin +1440.
Not testing the script. Running a script that deletes files without testing can accidentally remove important logs. Always test on a copy or with -delete replaced by -print first.
Permissions issues. If the script runs as a non-root user, it may not have permission to delete files owned by the web server. Use sudo crontab -e to ensure root runs it.

Tips

Use logrotate instead. Most Linux distributions already have logrotate set up to rotate and compress logs daily. You can configure logrotate to delete old logs automatically with the rotate and maxage directives. This is often cleaner than a custom cron job.
Be selective. Instead of deleting all files in a directory, target only log files: find "$LOG_DIR" -type f -name "*.log" -mtime +7 -delete.
Dry run first. Replace -delete with -print to list what would be deleted. Run it, review the list, then switch back.
Consider compression. If you need to keep logs for compliance, compress them instead of deleting: find ... -exec gzip {} \;.
Monitor disk usage. After the script runs, check df -h to confirm space is freed.

Troubleshooting

The cron job doesn’t run. Check that the script path is correct and executable. Run sudo crontab -l to see the entry. Also check the system’s cron log (e.g., /var/log/syslog on Debian) for errors. Ensure the cron service is running: systemctl status cron (or crond on CentOS).
Files are not being deleted. Test the script manually. If it works manually but not via cron, the issue is likely the environment (PATH). Add #!/bin/bash and use absolute paths for find and the directory. Also, cron may not have the same environment variables; use /usr/bin/find explicitly.
Permission denied errors. Ensure the script runs as root (via sudo crontab -e). If the script is in a user’s crontab, the user may not own the log files.
Disk space still full. The web server may still hold deleted files open. Restart the web server (e.g., systemctl restart nginx) to release the file handles. Also check if logs are being written elsewhere (e.g., journald).
Cron job runs but deletes nothing. Check the find command’s criteria. Use -mmin +1440 for exactly 24 hours. Also verify the log directory path is correct.

Frequently Asked Questions

Can I delete logs every 24 hours instead of every day at a fixed time?

Yes, you can use a cron job that runs every 24 hours from the time you set it, but cron doesn’t support “every 24 hours from now” directly. The closest is to run it daily at a specific time (e.g., 3 AM). If you need exactly 24-hour intervals, you could use a systemd timer with OnUnitActiveSec=24h, but for most purposes a daily cron is sufficient.

What is the difference between `-mtime` and `-mmin`?

-mtime +1 matches files modified more than 1 day ago, but the day is rounded up to whole days. -mmin +1440 matches files modified more than 1440 minutes (24 hours) ago, with minute precision. For exact 24-hour deletion, use -mmin +1440.

Will this delete the currently active log file?

It depends on your find command. If you use -type f without a name pattern, it will match the active log file. To avoid that, use a name pattern like *.log.* or exclude the exact filename with ! -name "access.log".

Is it safe to delete logs older than 24 hours?

Generally yes, but consider your compliance or debugging needs. If you might need to investigate an issue that happened more than a day ago, you may want to keep logs longer. Adjust the retention period accordingly.

Can I use this method on Windows servers?

No, cron is Unix/Linux-specific. On Windows, you can use Task Scheduler with a PowerShell script that uses Get-ChildItem and Remove-Item with Where-Object to filter by LastWriteTime.

What if I want to keep some logs but delete others?

Use multiple find commands in your script, each targeting a specific pattern or directory. For example, delete access.log.* but keep error.log.* for longer.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.