LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 05-02-2006, 06:38 AM   #1
MikeAtVillage
Member
 
Registered: May 2005
Location: Mid Wales (UK)
Distribution: Slackware 8.0, Suse 10.0/1/2, CentOS (SMEServer7)
Posts: 38

Rep: Reputation: 15
Huge syslog files !


Hi all,

having a nose through one of my servers I see that /var/log/syslog is now some 36Mb. There's nothing much reported wrong in it so how can I reduce the size.. or can I delete it ?!?!

Slackware 8.0 with Samba 2.2.8a acting purely as a file server.

Thanks

Mike
 
Old 05-02-2006, 07:04 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980
you can delete whatever logs you want, they are only text logs. you should normally be running logratote which will archive logs automatically and delete old ones. you may be on a 50mb max size trigger but you should be able to check your config under /etc/logrotate.conf or a similar file / directory.
 
Old 05-02-2006, 07:14 AM   #3
MikeAtVillage
Member
 
Registered: May 2005
Location: Mid Wales (UK)
Distribution: Slackware 8.0, Suse 10.0/1/2, CentOS (SMEServer7)
Posts: 38

Original Poster
Rep: Reputation: 15
Many thanks Chris, I thought it would be OK to delete but it's best to check :-) I'm not running logrotate at the moment but have seen so many references to it on this forum today that I will be downloading and installing it on all the servers.

ATB

Mike
 
Old 05-02-2006, 07:33 AM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980
if this is an area you are interested in perfecting, also check out syslog-ng, which provides a huge amount more granularity than standard syslog. just a suggestion though, and not related to your situation as such.
 
Old 05-02-2006, 07:59 AM   #5
MikeAtVillage
Member
 
Registered: May 2005
Location: Mid Wales (UK)
Distribution: Slackware 8.0, Suse 10.0/1/2, CentOS (SMEServer7)
Posts: 38

Original Poster
Rep: Reputation: 15
Um er. I renamed syslog to syslog.old but when I looked again after several minutes I noticed that it had grown slightly so I renamed it again, this time to xsyslog.old and waited a few more minutes..... and it had grown again ! Am I missing something here :-O
 
Old 05-02-2006, 12:59 PM   #6
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980
the file in memory will still be open, irrespective of what the name is. normally you would send a HUP signal to the syslogd process, .e.g "kill -HUP $(pidof syslogd)". this rereads the config files and resets itself iwthout restarting completely
 
Old 05-03-2006, 03:23 AM   #7
MikeAtVillage
Member
 
Registered: May 2005
Location: Mid Wales (UK)
Distribution: Slackware 8.0, Suse 10.0/1/2, CentOS (SMEServer7)
Posts: 38

Original Poster
Rep: Reputation: 15
Thanks again Chris, your assistance has been extremely helpful.

As well as restarting syslogd on that server I then examined syslog on the other 6 servers and spotted another error which thanks to your "kill -HUP (pid)" instructions I have been able to cure :-) BTW, my system did not like the $ preceding the pid.

ATB

Mike
 
Old 05-03-2006, 03:37 AM   #8
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980Reputation: 1980
no, the subcommand "/sbin/pidof syslogd" will print all pids for the syslogd process, and the $() wrap passes the result to the parent command, so the command i gave when used exactly should actually run something like "kill -HUP 1235" and so you don't need to actually know the pid number.
 
Old 05-03-2006, 05:56 AM   #9
MikeAtVillage
Member
 
Registered: May 2005
Location: Mid Wales (UK)
Distribution: Slackware 8.0, Suse 10.0/1/2, CentOS (SMEServer7)
Posts: 38

Original Poster
Rep: Reputation: 15
Thanks Chris, I'd wrongly assumed that the contents of the brackets was "pid of syslogd" and therefore I needed to use ps ax to find the pid. So, that's another very useful piece of information you've given me.

Cheers
 
  


Reply

Tags
syslog


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how to analyze huge tcpdump files? hedpe Linux - Networking 1 03-13-2006 07:22 PM
HUGE K3B Problem. Can't write ISO files! xbaez Linux - Software 2 07-06-2004 05:37 PM
huge log files - how do i shortn them? rosscopeeko Linux - General 2 03-30-2004 09:59 AM
Huge Firewall Log Files seanfitz Linux - Networking 1 01-29-2004 10:23 AM
Huge log files altor Linux - Newbie 4 09-03-2003 08:40 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 10:11 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration