Scenario

Disk usage on the /var partition is at 92% and increasing rapidly. You need to identify the largest files consuming space and determine if they're actively used by processes or need log rotation.

Task

Find the 10 largest files under /var and save them to /home/devops/largest_var_files.txt, check which processes are using these files and save results to /home/devops/file_processes.txt, and verify log rotation configuration for any log files found, saving results to /home/devops/logrotate_status.txt.

Example

# File: /home/devops/largest_var_files.txt
2.3G    /var/log/mysql/mysql-slow.log
1.8G    /var/lib/docker/overlay2/abc123/diff/app/data.db
1.3G    /var/log/nginx/access.log
891M    /var/cache/apt/archives/linux-image-generic.deb
655M    /var/log/syslog.1
450M    /var/log/myapp/app.log
...

# File: /home/devops/file_processes.txt
tail     44 root    3r   ... /var/log/mysql/sorted.log
tail     45 root    3r   ... /var/log/nginx/test.log
tail     46 root    3r   ... /var/log/hello.1
...

# File: /home/devops/logrotate_status.txt
/etc/logrotate.d/test:/var/log/test.log
/etc/logrotate.d/test:/var/log/hello.log
...

Step 1: Find the 10 largest files under /var

find /var -type f -exec du -h {} + 2>/dev/null | sort -rh | head -10 > /home/devops/largest_var_files.txt

The find searches for regular files, du -h calculates human-readable sizes, sort -rh sorts by size (largest first), head -10 limits to top 10, and 2>/dev/null suppresses permission errors.

Step 2: Check which processes are using these files

cat /home/devops/largest_var_files.txt | while read size filepath; do
  echo "$filepath:" >> /home/devops/file_processes.txt
  lsof "$filepath" 2>/dev/null >> /home/devops/file_processes.txt || echo "No process found" >> /home/devops/file_processes.txt
  echo "" >> /home/devops/file_processes.txt
done

The lsof command shows which process has each file open. The || echo provides fallback text when no process is using the file.

Step 3: Check log rotation configuration for log files

grep "\.log$" /home/devops/largest_var_files.txt | while read size filepath; do
  grep -r "$(basename $filepath)" /etc/logrotate.d/* 2>/dev/null >> /home/devops/logrotate_status.txt
done

Filters for .log files, then searches /etc/logrotate.d/ for rotation configuration using basename to extract just the filename.

Step 4: Review all three reports

cat /home/devops/largest_var_files.txt
cat /home/devops/file_processes.txt
cat /home/devops/logrotate_status.txt

View the complete analysis: largest files, which processes use them, and log rotation status.