logrotate — alert when a log file grows past rotation

#!/usr/bin/env bash
# /etc/cron.d/logrotate-stuck
# 0 */1 * * * root /opt/logrotate-stuck.sh

WATCH=${WATCH:-/var/log}
SIZE_GB=${SIZE_GB:-2}                 # alert per file > 2 GB
AGE_DAYS=${AGE_DAYS:-2}               # not rotated in N days

# Files larger than threshold AND not modified-time-suspicious (i.e.
# they are still being appended to but haven't been rotated).
HOT=$(find "$WATCH" -type f -size +${SIZE_GB}G -mtime -1 \
       -not -name '*.gz' -not -name '*.zst' 2>/dev/null)

if [ -n "$HOT" ]; then
  COUNT=$(echo "$HOT" | wc -l)
  curl -fsS "$HEARTBEAT_URL" --data "huge_logs=$COUNT,examples=$(echo "$HOT" | head -3 | tr '\n' ',')"
  exit 2
fi
echo "OK (no oversized active logs)"