# Audit Logging Mechanisms and Log Rotation Strategies in Desktop Commander MCP

> Explore Desktop Commander MCP's audit logging mechanisms and log rotation strategies. Discover how three logging subsystems ensure comprehensive observability without unbounded disk growth.

- Repository: [Eduard Ruzga/DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP)
- Tags: best-practices
- Published: 2026-07-09

---

**Desktop Commander MCP employs three specialized logging subsystems—tool-call auditing with automatic size-based rotation, fuzzy-search interaction tracking, and a central runtime logger—to provide comprehensive observability without unbounded disk growth.**

The Desktop Commander MCP server (wonderwhy-er/DesktopCommanderMCP) maintains a detailed audit trail of runtime operations through a multi-layered logging architecture. Understanding these audit logging mechanisms and log rotation strategies is essential for administrators monitoring tool usage, debugging performance issues, and ensuring compliance with forensic analysis requirements.

## Tool-Call Audit Logging with Automatic Rotation

The primary audit mechanism resides in [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts), which persists every invocation of built-in tools such as `fs`, `git`, and custom commands.

### How Tool-Call Tracking Works

The exported `trackToolCall` function constructs a timestamped entry and appends it to the file defined by the `TOOL_CALL_FILE` constant. This creates an immutable record of **who** called which tool and with what parameters.

```typescript
import { trackToolCall } from './utils/trackTools.js';

// Example: invoking a custom "run-script" tool
await trackToolCall('run-script', { script: 'build.sh', cwd: '/project' });

```

### Size-Based Rotation Strategy

When the audit log exceeds the threshold defined by `TOOL_CALL_FILE_MAX_SIZE` (approximately 10 MiB), the system automatically renames the current file with a timestamp suffix (`<base>_YYYY-MM-DD_HH-MM-SS.<ext>`) and starts a fresh log. This size-based rotation prevents unbounded disk growth while preserving recent history for forensic analysis.

## Fuzzy-Search Interaction Auditing

For performance tuning and user-behavior analysis, [`src/utils/fuzzySearchLogger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/fuzzySearchLogger.ts) maintains a dedicated audit trail of search operations.

The `FuzzySearchLogger.log(entry)` method appends JSON-serialized lines to `~/.claude-server-commander-logs/fuzzy-search.log`, capturing **what** queries were made, result counts, and execution timings. Unlike the tool-call logger, this subsystem does not implement automatic rotation—the file remains intentionally small due to single-line JSON entries and can be cleared manually via `FuzzySearchLogger.clear()`.

```typescript
import { FuzzySearchLogger } from './utils/fuzzySearchLogger.js';

await FuzzySearchLogger.log({
  query: 'open file',
  resultsCount: 12,
  durationMs: 34,
  timestamp: new Date().toISOString(),
});

```

## Central Runtime Logger

The [`src/utils/logger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/logger.ts) module provides a unified interface for general runtime events through the `logger` object and `logToStderr` helper.

Calls route through a buffered `log` function that writes to the MCP logger once initialized, with `logToStderr(level, msg)` mirroring messages to `stderr` for immediate visibility. This subsystem emits to stdout/stderr rather than files, relying on the host process or external logger for any rotation policies.

```typescript
import { logger } from './utils/logger.js';

logger.info('Desktop Commander started');
logger.error('Failed to load user configuration', { path: configPath });

```

## Configuration and Constants

Rotation behavior is controlled by constants defined in [`src/config.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts) (or `.js`). The `TOOL_CALL_FILE` constant specifies the audit log location, while `TOOL_CALL_FILE_MAX_SIZE` sets the ~10 MiB threshold that triggers rotation events in [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts).

## Summary

- Desktop Commander MCP uses three complementary logging subsystems to capture tool calls, fuzzy searches, and runtime events.
- The tool-call tracker in [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts) implements size-based rotation at approximately 10 MiB to prevent disk exhaustion.
- Fuzzy-search logs in `~/.claude-server-commander-logs/fuzzy-search.log` maintain JSON audit trails without automatic rotation but support manual clearing via `FuzzySearchLogger.clear()`.
- The central logger routes messages to stderr and stdout without file-based rotation, deferring to host environment policies.

## Frequently Asked Questions

### How does Desktop Commander MCP prevent audit logs from consuming excessive disk space?

The tool-call audit system in [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts) implements automatic size-based rotation when files reach approximately 10 MiB. Once the threshold specified by `TOOL_CALL_FILE_MAX_SIZE` is exceeded, the current log receives a timestamp suffix and the system creates a fresh file, effectively capping active log size while preserving historical archives.

### Where are fuzzy-search audit logs stored, and how can I clear them?

Fuzzy-search interactions are recorded in `~/.claude-server-commander-logs/fuzzy-search.log` as single-line JSON entries. While this subsystem lacks automatic rotation, administrators can programmatically clear the file by invoking `FuzzySearchLogger.clear()` from the [`src/utils/fuzzySearchLogger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/fuzzySearchLogger.ts) module.

### What is the difference between trackToolCall and the central logger?

`trackToolCall` specifically audits tool invocations with automatic file rotation and persistence, capturing structured data about command execution. The central logger in [`src/utils/logger.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/logger.ts) handles general runtime messaging (info, warning, error levels) and outputs to stderr/stdout without maintaining persistent log files or rotation logic.

### Can I configure the rotation threshold for tool-call audit logs?

The rotation threshold is defined by the `TOOL_CALL_FILE_MAX_SIZE` constant in [`src/config.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/config.ts). Administrators can modify this value before compilation to adjust the approximately 10 MiB default limit that triggers log rotation in the [`src/utils/trackTools.ts`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/src/utils/trackTools.ts) subsystem.