Find Logs Missing Logrotate Coverage

A log file can grow forever if no logrotate rule references it.

Command

find /var/log -type f -name '*.log' -printf '%p\n' | while read -r log; do grep -Rqs -- "$log" /etc/logrotate.conf /etc/logrotate.d || grep -Rqs -- "$(dirname "$log")/[*].log" /etc/logrotate.conf /etc/logrotate.d || printf '%s\n' "$log"; done

Before you run this

System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.

When not to use it: Do not treat absence from this output as complete proof of coverage; wildcard patterns can require manual review.

Expected output

Paths to .log files that do not appear directly in logrotate configuration.

System impact

Read-only, can be slow. Nothing changes. The loop prints log files that are not directly referenced by logrotate config text.

May require elevated permissions on protected paths or service-owned files.

Scope this to the smallest useful path or service on busy systems.

Recovery / rollback: no state is changed.

When to use it

Use during disk-growth triage or before onboarding a new app that writes its own logs.

When not to use it

Do not treat absence from this output as complete proof of coverage; wildcard patterns can require manual review.

Explanation-only example

Illustrated output, not a live lab run

This example is intentionally illustrative. It shows the command shape without killing real processes or changing your machine.

demo@lab:~$

$ find /var/log -type f -name '*.log' -printf '%p\n' | sort

/var/log/app/app.log
/var/log/app/debug.log
/var/log/nginx/access.log
/var/log/nginx/error.log

$ find /var/log -type f -name '*.log' -printf '%p\n' | while read -r log; do grep -Rqs -- "$log" /etc/logrotate.conf /etc/logrotate.d || grep -Rqs -- "$(dirname "$log")/[*].log" /etc/logrotate.conf /etc/logrotate.d || printf '%s\n' "$log"; done

/var/log/app/debug.log

View commands shown

These are the commands shown in the sanitized transcript.