[BlueOnyx:12743] Re: /var/log filling up with log files and running out of space

[George F. Nemeyer]

On Tue, 2 Apr 2013, Richard Morgan wrote:

> Maybe someone has a stronger solution or would care to comment on the
> above.  Will this survive a reboot?

There should be a cron-driven 'log rotate' function already on your system
that runs at least once per day.  It's essentially a bunch of scripts
defining what logs to look at and what to do with them.  It's chief
purpose is to keep log files at a managable size and purge or archive
older logs you likely wouldn't care about after a time.  Another benefit
is that other log analyis routines like Webalizer that read logs to
develop statistics have smaller (usually daily) files to process because
they don't have to waste time re-reading very old data every time they
run.

It can do many things, one of which is to look at a log file and process
it (delete/move/compress/archive/mail them/whatever) if the current file
reaches a stated size.  Usually, the install should have set up reasonable
defaults.

This is pretty much a Red Hat thing, so not unique to BX.  There's
documentation (man logrotate) around that gives examples of how to set it
up and what all it can do.  In very basic terms (and using hazy memory),
what usually happens is:

     Cron calls logrotate  according to cron's defined schedule.  You
         can also run it manually.
     Logrotate looks into a directory, /etc/logrotate.d to
         find entries for various types of logs (http, syslog, mail,
         etc) to process and works its way down the directory list
     The individual entries for the various /etc/logrotate.d log types
         contain definitions/scripts to tell how to process the log
         in question.  This is where you'd put size limits, age limits,
         how many old versions to keep, and other configuration info.

If for some reason cron isn't working, or dosen't call the logrotate
function, or the logrotate routines don't have proper config files, your
logs would grow indefinately.  If logrotate is running properly, then you
need to re-define how long you keep various logs, or specify some
alternate place to move them.

You'd may have to add a logroate config file for any log generating
programs that you may have installed on your own.  Generally, BX and RH
packages for programs contain some default logrotate configs as part of
the package and the installer puts them into /etc/logrotate.d.

Hope this helps.

=^_^=  Tigerwolf