Automated Server Log Cleanup via Email Alerts with SSH - n8n Workflow

DevOps engineers tired of manual server cleanups.
System administrators managing multiple self-hosted applications (Docker, Nginx).
Users seeking reliable n8n templates for incident response automation.
Anyone needing an automated, reactive solution for disk space management.

Server disk space exhaustion is a leading cause of unexpected service downtime, often caused by runaway application logs, outdated system packages, or large Docker caches. Manually responding to every 'disk full' alert is inefficient and reactive.

This specialized n8n workflow transforms a passive email alert into an active remediation action. By using a specific n8n trigger tied to IMAP alerts, the system automatically identifies the affected server and executes a detailed sequence of cleanup commands (including purging Nginx logs, running journalctl --vacuum, and pruning Docker builders) via the SSH n8n node. This particular n8n workflow is a crucial tool for maintaining system health and ensuring high availability.

This automation functions as a reactive incident management system, starting with a precise n8n trigger.

1. Initial Alert (n8n Trigger): The n8n workflow starts with the Check Disk Alert Emails n8n node, which acts as the primary n8n trigger. It monitors an IMAP inbox for new, unseen emails where the subject contains the keyword 'disk'.


2. IP Extraction: Upon detecting a relevant alert, the Extract Server IP from Email custom code n8n node executes a regular expression to parse the email subject line. This code is crucial for isolating the exact IP address of the server that needs attention.


3. Variable Preparation: The Prepare SSH Variables n8n node standardizes the necessary inputs (username, password, and the extracted server_ip) for the subsequent remote command execution.


4. Remote Cleanup Action: The core function of this n8n workflow is the Run Log Cleanup Commands via SSH n8n node. It securely connects to the target server using the supplied credentials and executes a powerful chained cleanup command. This command sequence is designed to free up space by cleaning system logs, Nginx/Apache logs, running apt-get clean, and pruning cached Docker images, resolving the high disk utilization alert automatically.

To deploy and use this powerful n8n workflow, follow these steps:

1. Import: Copy the provided n8n workflow JSON and import it into your n8n instance using the 'New' -> 'Import from JSON' option.


2. IMAP Credentials: Update the Check Disk Alert Emails n8n trigger node with your IMAP service credentials. Ensure the connection is authorized to read the inbox where your monitoring system sends disk alerts.


3. SSH Credentials: Set up the SSH Password credential used by the Run Log Cleanup Commands via SSH n8n node. This needs access to the jump host or server specified in the command structure.


4. Set Node Configuration: Review the Prepare SSH Variables n8n node. Replace the placeholder values for pwd (the sudo password) and server_user with the credentials required to execute privileged commands on the target servers.


5. Activation: Once credentials are set, activate the n8n workflow to enable automatic execution.

This n8n workflow utilizes several key n8n node components for data extraction and secure execution:

Check Disk Alert Emails (IMAP Trigger): This is the starting n8n trigger. Its function is to poll an inbox for new, unread emails (UNSEEN) specifically matching the subject filter containing disk. This ensures the n8n workflow only runs when a critical alert is received.
Extract Server IP from Email (Code Node): This custom code n8n node processes the incoming email subject line. It uses regex (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):9100 to reliably extract the server's IP address, which is vital for targeting the cleanup action.
Prepare SSH Variables (Set Node): This n8n node standardizes inputs. It captures the extracted server_ip from the previous step and sets static variables for the SSH command (like the user and password required for sudo).
Run Log Cleanup Commands via SSH (SSH Node): This is the action n8n node. It executes a complex, single command over SSH designed for system cleanup. Key parts of the command include:
Using echo '{{ $json.pwd }}' | sudo -S to pass the password for elevated privileges.
Targeted removal of compressed and old logs (rm -rf /var/log/.gz, .1, Nginx/Apache logs).
System maintenance (journalctl --vacuum-size=200M, apt-get clean, autoclean, autoremove).
Docker resource recovery (docker builder prune -af and status check docker system df).