I have a server that runs a mail relay (CentOS and Procmail). However, it's stopped doing the relay, as it is out of free disk space. I desperately need to free some space, and unfortunately the person who used to manage it left the company without leaving any documentation. Is there a quick way to find and delete old log files?

Desperately need help

The server may have several file systems; there's no point in making space except in the one that's full. What's the output of df -hT?

EDIT:

Log files are in /var/log

[root@msvfw log]# df -hT
Filesystem Type Size Used Avail Use% Mounted on
/dev/sda1 ext3 15G 14G 15M 100% /
none tmpfs 1014M 0 1014M 0% /dev/shm


Is it safe to delete everything in /var/log ?

Not recommended because there may be useful diagnostic information in there ... are there any real big ones? ls -lrt /var/log would show.

If you have the installation media or another similar system you could more safely remove the documentation under /usr/doc -- it's big (a few hundred MB) and not necessary (AFAIK!) for the running system.

EDIT: sorry -- that should be ls -lrS /var/log

Here are the alrgest log files. Root also has 3000 odd mails in queue; any quick way of gettign rid of them?


-r-------- 1 root root 146292 Apr 23 14:35 lastlog
-rw------- 1 root root 457617 Apr 23 15:25 cron
-rw------- 1 root root 581649 Mar 28 04:02 cron.4
-rw------- 1 root root 585080 Apr 18 04:02 cron.1
-rw------- 1 root root 585154 Apr 11 04:02 cron.2
-rw------- 1 root root 585364 Apr 4 04:02 cron.3
-rw------- 1 root root 9597908 Apr 23 15:25 messages
-rw------- 1 root root 10971241 Apr 18 04:02 messages.1
-rw------- 1 root root 11279331 Apr 11 04:02 messages.2
-rw------- 1 root root 11375466 Apr 4 04:02 messages.3
-rw------- 1 root root 22835273 Mar 28 04:02 messages.4
-rw------- 1 root root 55028534 Apr 11 04:02 maillog.2
-rw------- 1 root root 55499976 Apr 23 15:26 maillog
-rw------- 1 root root 55556762 Apr 4 04:02 maillog.3
-rw------- 1 root root 65473468 Apr 18 04:02 maillog.1
-rw------- 1 root root 73243004 Mar 28 04:02 maillog.4

I think can remove some old logfiles if you don't need for longer use(Ex- message, message.1.gz, message.2.gz etc.. as like this, check which is the most recent file)
Did you check each files size in /var/log directory because at this point we can advice to check logfile size only
can you post the output of "ll" in /var/log directory

If the system has been working OK the there should not be anything important in the messages.<n> files so they can go. Unless you want to audit the mail system, same goes for maillog.<n> files.

[root@msvfw log]# ll
total 366280
-rw-r----- 1 root root 3844 Apr 24 2009 acpid
drwx--S--- 2 amanda disk 4096 Feb 21 2005 amanda
-rw------- 1 root root 12508 Jul 11 2006 anaconda.log
-rw------- 1 root root 19851 Jul 11 2006 anaconda.syslog
-rw------- 1 root root 43727 Jul 11 2006 anaconda.xlog
drwxr-x--- 2 root root 4096 Jan 1 2006 audit
-rw-r--r-- 1 root root 1952 Apr 23 15:02 bitdefender_updater.log
-rw------- 1 root root 0 Apr 18 04:02 boot.log
-rw------- 1 root root 107 Apr 18 04:02 boot.log.1
-rw------- 1 root root 107 Apr 11 04:02 boot.log.2
-rw------- 1 root root 107 Apr 4 04:02 boot.log.3
-rw------- 1 root root 107 Mar 28 04:02 boot.log.4
drwxr-xr-x 2 canna canna 4096 Feb 22 2005 canna
-rw------- 1 root root 457935 Apr 23 15:30 cron
-rw------- 1 root root 585080 Apr 18 04:02 cron.1
-rw------- 1 root root 585154 Apr 11 04:02 cron.2
-rw------- 1 root root 585364 Apr 4 04:02 cron.3
-rw------- 1 root root 581649 Mar 28 04:02 cron.4
drwxr-xr-x 2 lp sys 4096 Aug 6 2006 cups
-rw-r--r-- 1 root root 14374 Apr 24 2009 dmesg
drwxr-x--- 2 exim exim 4096 Sep 8 2005 exim
drwxr-xr-x 2 root root 4096 Apr 24 2009 gdm
drwx------ 2 root root 4096 Apr 18 04:02 httpd
drwxr-xr-x 2 htt htt 4096 Jan 1 2006 iiim
drwx------ 2 root root 4096 Jul 11 2006 iptraf
-r-------- 1 root root 146292 Apr 23 14:35 lastlog
drwxr-xr-x 2 root root 4096 Jul 11 2006 mail
-rw------- 1 root root 55540518 Apr 23 15:30 maillog
-rw------- 1 root root 65473468 Apr 18 04:02 maillog.1
-rw------- 1 root root 55028534 Apr 11 04:02 maillog.2
-rw------- 1 root root 55556762 Apr 4 04:02 maillog.3
-rw------- 1 root root 73243004 Mar 28 04:02 maillog.4
drwxrwsr-x 2 root mailman 4096 Mar 21 2005 mailman
-rw------- 1 root root 9605463 Apr 23 15:30 messages
-rw------- 1 root root 10971241 Apr 18 04:02 messages.1
-rw------- 1 root root 11279331 Apr 11 04:02 messages.2
-rw------- 1 root root 11375466 Apr 4 04:02 messages.3
-rw------- 1 root root 22835273 Mar 28 04:02 messages.4
-rw-r----- 1 mysql mysql 8077 Apr 24 2009 mysqld.log
-rw-r----- 1 mysql mysql 0 Jul 11 2006 mysqld.log.1
drwxr-xr-x 3 news news 4096 Jul 11 2006 news
drwxr-xr-x 2 root root 4096 Jul 11 2006 Pegasus
-rwx------ 1 postgres postgres 0 Jul 11 2006 pgsql
drwx------ 2 root root 4096 Feb 21 2005 ppp
-rw-r--r-- 1 root root 82130 Apr 20 04:04 prelink.log
drwxrwx--- 2 quagga quagga 4096 Jan 1 2006 quagga
drwx------ 3 radiusd radiusd 4096 Apr 1 04:02 radius
-rw-r--r-- 1 root root 46093 Apr 23 04:02 rpmpkgs
-rw-r--r-- 1 root root 46093 Apr 17 04:03 rpmpkgs.1
-rw-r--r-- 1 root root 46093 Apr 10 04:03 rpmpkgs.2
-rw-r--r-- 1 root root 46093 Apr 3 04:02 rpmpkgs.3
-rw-r--r-- 1 root root 46093 Mar 27 04:03 rpmpkgs.4
drwxr-xr-x 2 root root 4096 Apr 23 00:00 sa
drwx------ 2 root root 4096 Mar 8 2006 samba
-rw-r--r-- 1 root root 70276 Jul 11 2006 scrollkeeper.log
-rw------- 1 root root 102 Apr 23 14:35 secure
-rw------- 1 root root 0 Apr 11 04:02 secure.1
-rw------- 1 root root 0 Apr 4 04:02 secure.2
-rw------- 1 root root 0 Mar 28 04:02 secure.3
-rw------- 1 root root 0 Mar 21 04:02 secure.4
-rw-r--r-- 1 root root 62 Apr 18 04:05 snmpd.log
-rw-r--r-- 1 root root 112 Apr 18 04:02 snmpd.log.1
-rw-r--r-- 1 root root 112 Apr 11 04:02 snmpd.log.2
-rw-r--r-- 1 root root 112 Apr 4 04:02 snmpd.log.3
-rw-r--r-- 1 root root 112 Mar 28 04:02 snmpd.log.4
-rw------- 1 root root 0 Apr 18 04:02 spooler
-rw------- 1 root root 0 Apr 11 04:02 spooler.1
-rw------- 1 root root 0 Apr 4 04:02 spooler.2
-rw------- 1 root root 0 Mar 28 04:02 spooler.3
-rw------- 1 root root 0 Mar 21 04:02 spooler.4
drwxr-x--- 2 squid squid 4096 Jan 1 2006 squid
drwxr-xr-x 2 uucp uucp 4096 Jul 11 2006 uucp
drwxr-xr-x 2 root root 4096 Feb 21 2005 vbox
-rw-rw-r-- 1 root utmp 384 Apr 23 14:35 wtmp
-rw-rw-r-- 1 root utmp 768 Mar 10 10:36 wtmp.1
-rw-r--r-- 1 root root 41006 Apr 24 2009 Xorg.0.log
-rw-r--r-- 1 root root 938 Jul 19 2006 yum.log

Yes you can remove the .1, .2 .3 files for message and cron, if you don't need maillog for any further clarification you can delete maillog too

1 members found this post helpful.

Again, mails to root may contain important diagnostic information -- so should (TM) be checked regularly. In an emergency you could delete /var/spool/mail/root but you might prefer to edit it and delete only mails more than say a month old.

Sometimes there's lots of files in /var/log/samba (and I've never found them useful!).

1 members found this post helpful.

To avoid this situation in future, better to ask your Administrator to add logrotate with compression for these logs

Thanks,

I've deleted these, and I've now got 300M free, which has allowed the mail relay to start working again. Thanks very much for your help, at least now I've got some breathing space to find a long term decision.

Alan

How are you doing with it now? Peak crisis over?

Any big old files in /tmp? What's ls -lrS /tmp output look like?

Will reply now we have some breathing space. Which logs? I didn't spot any big logs not being rotated.