LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 01-14-2018, 05:39 AM   #1
linuxqna
LQ Newbie
 
Registered: Jan 2018
Posts: 1

Rep: Reputation: Disabled
Arrow How to clean up /var/log/messages ?


1. /var mount was filled to 100% and found that /var/log/messages was occupying 3.5 GB of data (which was more than 50% of space allocated to the mount)
2. Deleted the /var/log/messages - using rm -rf /var/log/messages
3. Even after deletion, the space was still at 100%. Upon checking I was able to see found the process with "/var/log/messages (deleted)" as the output of lsof command.
4. Killed the process id of the above mentioned process and syslog service went down
5. Started syslog service using service syslog and things were all back to normal. (message file was recreated with 0 Byte)

# service syslog-ng status
Checking for syslog-ng service: dead but pidfile exists. [FAILED]
# service syslog-ng start
Starting syslog-ng: [ OK ]
# service syslog-ng status
Checking for syslog-ng service: 36468 running [ OK ]
 
Old 01-14-2018, 06:20 AM   #2
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 2,731

Rep: Reputation: 1130Reputation: 1130Reputation: 1130Reputation: 1130Reputation: 1130Reputation: 1130Reputation: 1130Reputation: 1130Reputation: 1130
Lesson: never delete a file that something has open. It just hides the file but keeps the i-node and the space is still used (only now it is harder to GET to or see).

The command
Code:
>/var/log/messages
or
echo > /var/log/messages
is valid and will NOT delete the file but will OVERWRITE the file and release the space used.

Note that there must be a little space free on the file system for this to work, as it does require that the new information be written to the structure. No space to write, means it is a bit more difficult to make this work. It also requires that you have full permissions to write the file, which may require root access: that is normal on a RHEL based system.

This is the more correct way to deal with the problem: rm will just make it worse if the file is in use.

The advice to use this technique after stopping syslogd was good advice and that should have worked. I have seen systems require a reboot, but not for a long time. (I think RHEL was current on early version 4 at the time.)

Last edited by wpeckham; 01-14-2018 at 06:24 AM.
 
2 members found this post helpful.
Old 01-14-2018, 06:32 AM   #3
pan64
LQ Guru
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 11,514

Rep: Reputation: 3458Reputation: 3458Reputation: 3458Reputation: 3458Reputation: 3458Reputation: 3458Reputation: 3458Reputation: 3458Reputation: 3458Reputation: 3458Reputation: 3458
reboot is required (only) when you cannot find the process keeping the deleted file in use. Stopping syslogd probably is not a good idea, but if you need to do that better to do it using the service command (instead of just killing it). And also probably better to restart it immediately (instead of stopping).
 
Old 01-14-2018, 10:43 AM   #4
scasey
Senior Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.5
Posts: 2,024

Rep: Reputation: 629Reputation: 629Reputation: 629Reputation: 629Reputation: 629Reputation: 629
setup logrotate configured to rotate logs weekly and keep only 4. That will prevent any log from filling up your disk by purging everything over 4 weeks old every week.
(yes, I know this doesn't address the OP's question, but that had already been adequately answered...Just a thought to help prevent the problem in the future)

Last edited by scasey; 01-14-2018 at 10:46 AM.
 
2 members found this post helpful.
Old 01-14-2018, 06:47 PM   #5
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Yawnstown, Ohio
Distribution: Mojave
Posts: 9,345
Blog Entries: 36

Rep: Reputation: Disabled
n/m. sorry.
 
Old 01-14-2018, 10:06 PM   #6
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Debian, Mageia, and whatever VMs I happen to be playing with
Posts: 14,195
Blog Entries: 24

Rep: Reputation: 3858Reputation: 3858Reputation: 3858Reputation: 3858Reputation: 3858Reputation: 3858Reputation: 3858Reputation: 3858Reputation: 3858Reputation: 3858Reputation: 3858
I ran into a problem like this with a Debian install many years ago; I think it was v. 5. Installing logrotate, as scasey recommended, took care of it.
 
1 members found this post helpful.
Old 01-15-2018, 09:43 AM   #7
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 9,078
Blog Entries: 4

Rep: Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170
logrotate is a very handy utility that can actually "rotate" files in any directory.

You can add other directories into the configuration file that it uses when run by cron, and/or you can run it separately. It's a specialist at doing one particular task, but it's a very flexible specialist. (See man 8 logrotate.)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] iptables troubleshooting icmp and best place to log /var/log/messages or /var/log/iptables JockVSJock Linux - Security 18 02-12-2016 01:31 AM
[SOLVED] Central log server aggregating all messages to /var/log/messages lhiggie1 CentOS 6 01-20-2015 05:44 PM
[SOLVED] No /var/log/messages , syslog , kern.log -but cat /var/spool/octopussy/octo_fifo masuch Linux - Newbie 4 06-13-2012 09:05 PM
/var/log/messages and /var/log/cron not working sigkill Linux - Software 6 08-09-2008 02:08 PM
How to clean up /var/log/messages ? JaBa Linux - General 10 10-30-2004 01:32 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 01:06 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration