Urza9814 Posted September 4, 2006 Report Share Posted September 4, 2006 Ok, so I was having trouble with my system running out of disk space all the time. And I couldn't figure out how or why, but it seemed to be eating through 100MB an hour, and once it filled up, apps would start crashing, and if I rebooted or the whole comp crashed the GUI wouldn't load. Well, I discovered my problem. /var/log is 33GB. yes, 33 GIGAbytes. I think the biggest one is syslog.1, measuring in at 14.9GB So anyways, two questions: 1) It's safe to just do a 'rm -R -f /var/log/*', right? It won't screw anything up? 2) How do I limit the logs? I don't really want to STOP logging, but is there any way to have it, like, delete messages over one week old or something? Quote Link to comment Share on other sites More sharing options...
Gowator Posted September 4, 2006 Report Share Posted September 4, 2006 Use log rotate (urpmi it then install it and see the man entry .... since you really need to do this yourself and decide on the size and rotation etc.) Quote Link to comment Share on other sites More sharing options...
daniewicz Posted September 4, 2006 Report Share Posted September 4, 2006 (edited) Urza9814: On my Mandriva 2005 system, I do not have a syslog.1 file. Only syslog. What is being logged in syslog.1 to cause all of this size? :unsure: Something seems wrong. I am wondering if you have a misconfigured application causing this excessive logging. Edited September 4, 2006 by daniewicz Quote Link to comment Share on other sites More sharing options...
Urza9814 Posted September 4, 2006 Author Report Share Posted September 4, 2006 (edited) I'm actually thinking it might be some kind of harddrive or filesystem problem that caused all this. Maybe an incorrect shutdown? Because I have syslog.1, syslog.2, syslog.3, etc, which seems like they were most likely old syslog files that got renamed instead of deleted when something went wrong. All of them are empty. The one is several gigs, the others are a few megs. Only thing I know of that creates a blank file that's several gigs in size is filesystem errors. I'm not too concerned what caused them if that's the case...I'll just delete and see if they come back for now. I've had to reinstall several times recently, the largest problem being files left over from a failed xen install (which screwed up my entire system) making a bootloader re-installation impossible...so I finally went and cleaned all that up the other day...but yea. There are two files around 15GB, one being syslog.1 and the other being kernel/info.1, neither of which should be there, so I'll just dump 'em and see what happens for now. Oh yea...I just deleted them...exactly 30GB free now. Wonder what the odds are of two files being exactly 30GB.... I do have some pretty big normal logfiles too though...not a few gigs, but a few that are in the megabytes... Edited September 4, 2006 by Urza9814 Quote Link to comment Share on other sites More sharing options...
coverup Posted September 4, 2006 Report Share Posted September 4, 2006 (edited) I have always had those syslog (and other log files as well) files gzipped, i.e, syslog.1.gz, etc. They are rotated and compressed on a monthly basis. Unless it's not one of the "improvements" introduced in the latest Mandriva, I don't see a reason why this does not work for you... Do you run the system on a laptop? That could be only reason why logs are not properly rotated - the log rotating cron job runs at about 4am, so you may need to leave your laptop on overnight at least once a month (or change the cron schedule). Edit: Do you have gzip utility by the way? Apparently log rotate defaults to using gzip to compress those log files. Edited September 4, 2006 by coverup Quote Link to comment Share on other sites More sharing options...
scoonma Posted September 5, 2006 Report Share Posted September 5, 2006 (edited) You can install anacron to make sure cronjobs are actually run even if the machine is not working all day. The package info says it's preconfigured for Mandriva, so it's very easy to use. :-) Cheers, scoonma Edited September 5, 2006 by scoonma Quote Link to comment Share on other sites More sharing options...
Urza9814 Posted September 7, 2006 Author Report Share Posted September 7, 2006 syslog is back up to 2.2GB...and still completely empty.... Quote Link to comment Share on other sites More sharing options...
daniewicz Posted September 7, 2006 Report Share Posted September 7, 2006 Only thing I know of that creates a blank file that's several gigs in size is filesystem errors. So maybe you have a hardware problem? Anything errors being reported in /var/log/messages? Quote Link to comment Share on other sites More sharing options...
michaelcole Posted September 7, 2006 Report Share Posted September 7, 2006 syslog is back up to 2.2GB...and still completely empty.... If you want to do a quick shrink on a log file and not lose all the information that has been store you can try this. I do it when i have looked at the logs and just want to reclaim space. tail -n100 syslog > syslog this will give you the last 100 lines in the new file and the space will reduce. I have noticed with my KMLdonkey that it makes large files like 200MB or even 1GB but the file is not actually using the space, it is the file size it will get to but not yet there. try ls -sl the -s option will tell you the space that the file is actually using in blocks. Quote Link to comment Share on other sites More sharing options...
Urza9814 Posted September 7, 2006 Author Report Share Posted September 7, 2006 ohh wow. nevermind. I tried to look at /var/log/messages....and it wouldn't load with kate or kwrite...and it wouldn't load at all...and so I opened it with less....and then realized to try opening syslog with less...and it's FLOODED with shorewall messages. My bad. Unfortunatly I can't seem to figure out how to fix that either...I do everything through webmin...and I can't find anything about it in webmin...lol Quote Link to comment Share on other sites More sharing options...
scoonma Posted September 7, 2006 Report Share Posted September 7, 2006 If shorewall is causing that big amount of log data, you can simply edit /etc/shorewall.conf to suit your needs. It's possible to choose between multiple log levels for different "hit" conditions. Cheers, scoonma Quote Link to comment Share on other sites More sharing options...
Urza9814 Posted September 7, 2006 Author Report Share Posted September 7, 2006 ah...aight. I think I got it figured it. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.