LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 01-13-2003, 07:07 PM   #1
onurb
Member
 
Registered: Dec 2002
Posts: 263

Rep: Reputation: 30
log-files longer than 4 Gig


Using Mandrake 9.0 I noticed something diffrent from 8.2:
My /var/log/syslog and /var/ log/kernel/info get longer than 4 Gig each. A few days ago I cleared them, and today they are more then 2.5 Gig again !
My / partition is 20G but it fills up quickly as both those files grow over 8G !
Anyone an idea ?
( the /var/log/messages has a fixed length, as lines are added, the disapear at the top )

Bruno
 
Old 01-14-2003, 07:10 AM   #2
vladkrack
Member
 
Registered: Oct 2002
Location: Curitiba - Brazil
Distribution: Conectiva
Posts: 334

Rep: Reputation: 30
There's an aplication that can handle that for you, it's logrotate:

ftp://ftp.redhat.com/pub/redhat/linu...de/SRPMS/SRPMS
 
Old 01-14-2003, 07:53 AM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529
Hmm. You better find out what's filling your logs.
For instance if your entry looks like this:
kern.=debug;kern.=info;kern.=notice /var/log/kernel/info
it means everything from the informational level (6) and up will be logged:
Code:
# loglevel defined in <linux/kernel.h>:
# KERN_EMERG    "<0>"  /* system is unusable               */
# KERN_ALERT    "<1>"  /* action must be taken immediately */
# KERN_CRIT     "<2>"  /* critical conditions              */
# KERN_ERR      "<3>"  /* error conditions                 */
# KERN_WARNING  "<4>"  /* warning conditions               */
# KERN_NOTICE   "<5>"  /* normal but significant condition */
# KERN_INFO     "<6>"  /* informational                    */
# KERN_DEBUG    "<7>"  /* debug-level messages             */
To quickly see what DOSses your logs you could add this entry (check your tab usage) and restart syslogd (kill -HUP syslog):
kern.info /dev/tty12
This will log all messages with the kern facility from info level up into your log (as the first rule shows) but also to tty12 (switch to it with ALT+CTRL+F12). Watch the output for over and over repeating lines.
 
Old 01-14-2003, 01:03 PM   #4
onurb
Member
 
Registered: Dec 2002
Posts: 263

Original Poster
Rep: Reputation: 30
No there are no error messages, mostly it is this kind of stuff:

/var/log/kernel/info:
Jan 13 23:30:42 localhost kernel: ppp_synctty: send buffer, count = 20
Jan 13 23:30:42 localhost kernel: FF 03 C0 21 01 01 00 10 ...!....
Jan 13 23:30:42 localhost kernel: 02 06 00 00 00 00 05 06 ........
Jan 13 23:30:42 localhost kernel: 27 2B 2C F2 '+,.
Jan 13 23:30:42 localhost kernel: ppp_synctty: receive buffer, count = 18
Jan 13 23:30:42 localhost kernel: FF 03 C0 21 01 95 00 0E ...!....
Jan 13 23:30:42 localhost kernel: 03 04 C0 23 05 06 5A 88 ...#..Z.
Jan 13 23:30:42 localhost kernel: C9 C6 ..
Jan 13 23:30:42 localhost kernel: ppp_synctty: send buffer, count = 18
Jan 13 23:30:42 localhost kernel: FF 03 C0 21 02 95 00 0E ...!....
Jan 13 23:30:42 localhost kernel: 03 04 C0 23 05 06 5A 88 ...#..Z.
Jan 13 23:30:42 localhost kernel: C9 C6 ..
Jan 13 23:30:42 localhost kernel: ppp_synctty: receive buffer, count = 20
Jan 13 23:30:42 localhost kernel: FF 03 C0 21 02 01 00 10 ...!....
Jan 13 23:30:42 localhost kernel: 02 06 00 00 00 00 05 06 ........
Jan 13 23:30:42 localhost kernel: 27 2B 2C F2 '+,.
Jan 13 23:30:42 localhost kernel: ppp_synctty: send buffer, count = 36
Jan 13 23:30:42 localhost kernel: FF 03 C0 23 01 01 00 20 ...#...
Jan 13 23:30:42 localhost kernel: 14 6F 6E 75 72 62 40 77 .onurb@w

(same goes for the /var/log/syslog , all kind of ppp messages)

I've got that damn Speedtouch USB modem, I think that's filling my logs !
I have found a solution myself: rm /var/log/kernel/info and rm /var/log/syslog once a day with kcron. It builts a new log automaticly.

Thanks for your help, Bruno
 
Old 01-15-2003, 07:15 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529
Seems like you're using debug output: disable it, because just deleting the logs w/o looking ain't a good option IMO.
 
Old 01-15-2003, 12:35 PM   #6
onurb
Member
 
Registered: Dec 2002
Posts: 263

Original Poster
Rep: Reputation: 30
Where and how do I disable debug output ?

Bruno
 
Old 01-15-2003, 03:09 PM   #7
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529
Look in file /etc/ppp/options (or somewhere around there) for "kdebug 31" which is kernel debugging ppp at level 31 (way verbose):
0 - no debugging
1 - debug messages
2 - log incoming packets
4 - log outgoing packets
8 - log tty output buffers
16 - log tty input buffers

Make it read "kdebug 0". Dunno if you have to reload modules or reconnect to make it work. You can always reboot.
 
Old 01-15-2003, 03:14 PM   #8
onurb
Member
 
Registered: Dec 2002
Posts: 263

Original Poster
Rep: Reputation: 30
Thanks unSpawn, looks like a good tip.
my /etc/ppp/peers/adsl says: kdebug 1 I'll change that to 0

I recieved another interesting tip at Mandreke-Club forum:

Anacron !

As my computer is not on 24 hrs a day, cron-jobs like logrotate are forgotten because they run at 4 o'clock in the morning. Anacron detects forgotten cron-jobs and executes them shortly after boot. ( updatedb is another forgotten job )

It looks there are quiet some other jobs that have to run at night, once a week or once a month, if anyone has an idea what those jobs might be, let me know, I got curious now !

Anacron was installed by default in MDK 8.1 and 8.2 but not in MDK 9.0

For those of you who's computer is not up 24/7 :
urpmi anacron (CD 3)

Bruno

Last edited by onurb; 01-15-2003 at 03:21 PM.
 
Old 01-15-2003, 03:34 PM   #9
vladkrack
Member
 
Registered: Oct 2002
Location: Curitiba - Brazil
Distribution: Conectiva
Posts: 334

Rep: Reputation: 30
Some other jobs:

makewhatis - create a whatis database
postfix - check for problems
slocate - the aplication that updatedb points
tmpwatch - cleans the old/unused files in tmp
and anacron itself

there others too ...
 
Old 01-15-2003, 03:47 PM   #10
onurb
Member
 
Registered: Dec 2002
Posts: 263

Original Poster
Rep: Reputation: 30
Lovely, thanks
 
Old 01-15-2003, 10:23 PM   #11
michaelk
Moderator
 
Registered: Aug 2002
Posts: 14,932

Rep: Reputation: 1520Reputation: 1520Reputation: 1520Reputation: 1520Reputation: 1520Reputation: 1520Reputation: 1520Reputation: 1520Reputation: 1520Reputation: 1520Reputation: 1520
Add

daily
rotate 5
size=200k

to your /etc/logrotate.d/syslog
inbetween the brackets where it says
/var/log/messages
 
Old 01-16-2003, 01:47 PM   #12
onurb
Member
 
Registered: Dec 2002
Posts: 263

Original Poster
Rep: Reputation: 30
Looks like a very usefull tip, aswell it gave me an insight in what logs are held in mandrake, thanks

Bruno
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to split a 9 Gig folder in 2x4.5 Gig folders jayhel Slackware 5 08-19-2005 12:36 AM
Can no longer log in as user dive Slackware 7 07-31-2005 12:42 PM
XFree86.0.log file growing during normal use to several Gig. mccarta Linux - Hardware 2 06-09-2004 03:48 AM
Why my 80 gig hard drive only shows 70 gig? dsuratman Linux - Newbie 3 11-20-2003 12:54 AM
Can log files be time stamped? (such as FTP login and transfer log files) bripage Linux - Networking 6 08-08-2002 11:55 PM


All times are GMT -5. The time now is 12:54 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration