Huge syslog files !

MikeAtVillage · 05-02-2006, 06:38 AM

Hi all,

having a nose through one of my servers I see that /var/log/syslog is now some 36Mb. There's nothing much reported wrong in it so how can I reduce the size.. or can I delete it ?!?!

Slackware 8.0 with Samba 2.2.8a acting purely as a file server.

Thanks

Mike

acid_kewpie · 05-02-2006, 07:04 AM

you can delete whatever logs you want, they are only text logs. you should normally be running logratote which will archive logs automatically and delete old ones. you may be on a 50mb max size trigger but you should be able to check your config under /etc/logrotate.conf or a similar file / directory.

MikeAtVillage · 05-02-2006, 07:14 AM

Many thanks Chris, I thought it would be OK to delete but it's best to check :-) I'm not running logrotate at the moment but have seen so many references to it on this forum today that I will be downloading and installing it on all the servers.

ATB

Mike

acid_kewpie · 05-02-2006, 07:33 AM

if this is an area you are interested in perfecting, also check out syslog-ng, which provides a huge amount more granularity than standard syslog. just a suggestion though, and not related to your situation as such.

MikeAtVillage · 05-02-2006, 07:59 AM

Um er. I renamed syslog to syslog.old but when I looked again after several minutes I noticed that it had grown slightly so I renamed it again, this time to xsyslog.old and waited a few more minutes..... and it had grown again ! Am I missing something here :-O

acid_kewpie · 05-02-2006, 12:59 PM

the file in memory will still be open, irrespective of what the name is. normally you would send a HUP signal to the syslogd process, .e.g "kill -HUP $(pidof syslogd)". this rereads the config files and resets itself iwthout restarting completely

MikeAtVillage · 05-03-2006, 03:23 AM

Thanks again Chris, your assistance has been extremely helpful.

As well as restarting syslogd on that server I then examined syslog on the other 6 servers and spotted another error which thanks to your "kill -HUP (pid)" instructions I have been able to cure :-) BTW, my system did not like the $ preceding the pid.

ATB

Mike

acid_kewpie · 05-03-2006, 03:37 AM

no, the subcommand "/sbin/pidof syslogd" will print all pids for the syslogd process, and the $() wrap passes the result to the parent command, so the command i gave when used exactly should actually run something like "kill -HUP 1235" and so you don't need to actually know the pid number.

MikeAtVillage · 05-03-2006, 05:56 AM

Thanks Chris, I'd wrongly assumed that the contents of the brackets was "pid of syslogd" and therefore I needed to use ps ax to find the pid. So, that's another very useful piece of information you've given me.

Cheers