What are the non-obvious maintenance tasks that need to be done on a Magento site?

Question

There are a few things that need to be done to keep a Mage install clean:

• error log checking
• log rotation
• var/report rotation
• clearing out no-longer-used images
• applying security patches
• component updates

I'm sure there are other things that are a good idea, what else is there?

Answer 1

You've covered a lot.

But you forgot the most important of all - BACKUPS.

• Schedule backups in off-peak hours and (ensure they're running!)
• Schedule fire-drills with your ecom team to TEST YOUR BACKUPS

I would add the following:

• Set up log.php to clean DB logs like visitor logs
• Set up indexer.php to reindex specific indexes on a schedule (< 1.13EE)
• Set up compiler.php to recompile on a schedule or after deployments (post-deploy hooks or part of your deployment routine).
• Bring production snapshots down to staging/dev boxes periodically
• Review admin users monthly to ensure to remove now-unauthorized users
• Rotate passwords frequently

Some other things to check/consider:

• Review traffic reports and check for spikes / bots that may be hitting you (our repeat offenders: Yandex / Baidu) or bots/crawlers that ignore NOFOLLOW or robots.txt rate limiting
• Make sure your sitemap.xml is running frequently (daily/weekly) - this is the thing that is missed most often!
• Make sure site permissions and file ownerships are correct (I set up a Pingdom alert for this) - this is very important for multi-person teams or managed hosting services that chmod 777 -R willy-nilly.

Edit from @kalenjordan:

• Monitor exceptions that are logged, whether by checking exception.log manually, or setting up some kind of notification for exceptions (email or otherwise).
• Review 404 error logs and setup redirects to prevent 404's from getting hit.

Answer 2

• Flushing out spammy reviews.
• Updating misc libraries (or at least keeping up on the changes) - It's pretty nice when you can start working on a new front-end javascript feature without having to worry about updating potentially incompatible versions.
• Admin config settings tend to get set by many modules, but never removed. Good to go through and clean these items out if they're unused.
• CSS can almost always use some level of refactoring. If you find that you have some "spare time" to fill, go through and fix box model defects in CSS or just do some cross browser checking.
• General testing. Use the site and find areas the need improvement.
• Checking client content updates. They tend to think posting 25mb of images on a CMS page that will get 5000 hits each day for a month is a good idea.

These might seem obvious to some, but are definitely areas that I have seen could use improvement.

Answer 3

Disable all modules that arent in use, which should also include Mage_AdminNotification and Mage_Connect

edit: because the only upgrades you ought to be doing on a production site should be deployed from a staging environment, not magento connect.

Answer 4

Oh, one thing we're doing I forgot about:

• Check whether the files on the webserver are the same as the files that you expect to be there.

Ideally you'll have a tag or release in your source control system that you can compare against.

The point of this is to get notified when either someone modifies files on live deliberately (sometimes this is the only way to get visibility on a bug that only shows up on live, alas), or when an attacker modifies your files or uploads something new. Most attackers these days aren't there to deface your site, so you might not notice that your index page is now serving spam links to Googlebot user agents...

Answer 5

We have to delete via

rm -rf media/catalog/product/cache/*

every week. Magento caches always all images. And with a large shop the cache folders grows to many many GB until the disk is full.

Another task we do is to remove order quotes older than 90 days.