Linux Log Rotation Audit: Prevent Disk Full with Python Analysis (2026)

Log files are the silent storage consumers that cause the most preventable server outages. A web server processing thousands of requests per second can fill gigabytes of disk space in hours. Without proper log rotation, it's only a matter of time before /var/log consumes all available storage and brings your server to its knees.

This guide covers log rotation auditing with dargslan-log-rotate, a free Python tool that analyzes your logrotate configuration, finds large and unrotated log files, and helps prevent disk space emergencies.

The Log Rotation Problem

Most Linux distributions come with logrotate configured for system logs, but custom applications, Docker containers, and third-party services often lack proper rotation. Common scenarios that lead to disk-full emergencies:

• Application logs without rotation — Custom apps writing to /var/log/myapp.log without any rotation config
• Docker container logs — Docker's default JSON logger has no size limit
• Database query logs — MySQL/PostgreSQL query logging fills disks quickly
• Debug logging left on — Verbose logging enabled during troubleshooting and never turned off
• Missing compression — Rotated logs stored uncompressed, using 10x more space

Installing dargslan-log-rotate

pip install dargslan-log-rotate

# Or install the complete toolkit
pip install dargslan-toolkit

CLI Usage

# Full log rotation report
dargslan-logrot report

# Show logrotate configurations
dargslan-logrot configs

# Log directory usage summary
dargslan-logrot usage

# Find logs larger than 50MB
dargslan-logrot large -m 50

# Show issues (unrotated, oversized)
dargslan-logrot issues

# JSON output
dargslan-logrot json

Python API

from dargslan_log_rotate import LogRotateAudit

lr = LogRotateAudit()

# Full report
lr.print_report()

# Parse logrotate configurations
configs = lr.parse_logrotate_entries()
for c in configs:
    print(f"  {c['path']:40s} {c['frequency']:8s} rotate:{c['rotate']} compress:{c['compress']}")

# Find large log files
large = lr.find_large_logs(min_size_mb=50)
for l in large:
    print(f"  {l['size_human']:>10}  {l['path']}")

# Find unrotated logs (old and large)
unrotated = lr.find_unrotated(max_age_days=30, min_size_mb=10)

# Log directory usage
usage = lr.log_dir_usage()
print(f"Total log size: {usage['total_size_human']}")
print(f"Compressed: {usage['compressed_size_human']}")

# Run audit
issues = lr.audit()
for i in issues:
    print(f"  [{i['severity']}] {i['message']}")

Logrotate Configuration Reference

# /etc/logrotate.d/nginx
/var/log/nginx/*.log {
    daily                    # Rotate daily
    rotate 14                # Keep 14 rotated files
    compress                 # Compress with gzip
    delaycompress            # Don't compress most recent
    missingok                # Skip if log doesn't exist
    notifempty               # Skip if log is empty
    create 0640 www-data adm # New log file permissions
    sharedscripts            # Run postrotate once (not per log)
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid)
    endscript
}

Key Directives

• daily/weekly/monthly — Rotation frequency
• rotate N — Number of rotated files to keep
• compress — Gzip old log files (saves ~90% space)
• delaycompress — Wait one cycle before compressing (for apps that might still write to old file)
• copytruncate — Copy and truncate instead of move (for apps that hold file handles)
• maxsize 100M — Force rotation when file exceeds size, regardless of schedule
• minsize 10M — Only rotate if file exceeds minimum size

Logrotate Commands

# Test configuration (dry run)
logrotate -d /etc/logrotate.conf

# Force rotation (useful for testing)
logrotate -f /etc/logrotate.conf

# Verbose output
logrotate -v /etc/logrotate.conf

# Check rotation status
cat /var/lib/logrotate/status

# Manual log cleanup
find /var/log -name "*.gz" -mtime +30 -delete
journalctl --vacuum-size=100M
journalctl --vacuum-time=7d

Application-Specific Log Rotation

Docker Container Logs

# /etc/docker/daemon.json
{
    "log-driver": "json-file",
    "log-opts": {
        "max-size": "10m",
        "max-file": "3"
    }
}

Custom Application Logs

# /etc/logrotate.d/myapp
/var/log/myapp/*.log {
    daily
    rotate 7
    compress
    missingok
    notifempty
    copytruncate
    maxsize 100M
}

Automated Log Audit

#!/usr/bin/env python3
# /opt/scripts/log-audit.py
from dargslan_log_rotate import LogRotateAudit

lr = LogRotateAudit()

# Check total log usage
usage = lr.log_dir_usage()
total_mb = usage['total_size'] / (1024 * 1024)
if total_mb > 500:
    print(f"WARNING: /var/log is {usage['total_size_human']}")

# Find large unrotated logs
large = lr.find_large_logs(min_size_mb=100)
if large:
    print(f"ALERT: {len(large)} log files over 100MB!")
    for l in large:
        print(f"  {l['size_human']:>10} {l['path']}")

Log rotation is one of those unglamorous tasks that prevents catastrophic failures. dargslan-log-rotate makes auditing your log rotation setup painless — find large files, check configurations, and identify issues before they fill your disk.

Install now: pip install dargslan-log-rotate — or get all 15 tools: pip install dargslan-toolkit

Download our free Log Rotation Cheat Sheet for quick reference.