Hosting Operations
Read-only, can be slowReview Log Files Before Cleanup
Log files are suspected during disk pressure and you need a compact review list before changing retention or truncating anything.
Command
find /var/log -xdev -type f -printf '%10s %TY-%Tm-%Td %p\n' 2>/dev/null | sort -nr | head -50Before you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not treat log cleanup as a substitute for fixing missing rotation or runaway logging.
Expected output
A size-sorted list of log files with modification dates and paths.
System impact
Read-only, can be slow. Nothing changes. The command prints log file sizes, dates, and paths for review.
May require elevated permissions on protected paths or service-owned files.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use before truncating, compressing, rotating, or moving logs during disk incidents.
When not to use it
Do not treat log cleanup as a substitute for fixing missing rotation or runaway logging.
next steps
Related commands
Rank Old Cleanup Candidates by Size
The oldest file is not always the file that buys back meaningful space.
find /var -xdev -type f -mtime +7 -printf '%s %TY-%Tm-%Td %p\n' 2>/dev/null | sort -nr | head
Check systemd Journal Disk Usage
Before deleting random logs, ask journald how much disk it owns.
journalctl --disk-usage
Find Open Deleted Files with lsof
A file can be deleted but still occupy disk while a process holds it open.
lsof +L1
Find Directories Burning Inodes
Inode cleanup starts by finding the directory with too many files.
find /var/cache -xdev -type f -printf '%h\n' 2>/dev/null | sort | uniq -c | sort -nr | head
Find Logs Missing Logrotate Coverage
The biggest log risk is often the file no policy mentions.
find /var/log -type f -name '*.log' -printf '%p\n' | while read -r log; do grep -Rqs -- "$log" /etc/logrotate.conf /etc/logrotate.d || grep -Rqs -- "$(dirname "$log")/[*].log" /etc/logrotate.conf /etc/logrotate.d || printf '%s\n' "$log"; done
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.