LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-01-2015, 10:33 PM   #1
osama.mansoor
Member
 
Registered: Oct 2015
Posts: 43

Rep: Reputation: Disabled
logwatch folder


Hi Experts,

We Have Oracle Linux 6.5
Last week we are in trouble with space issues in "/" mount partitions after some troubleshooting we have found that data is increasing in /var/cache/logwatch folder on daily basis.


i check with chkconfig -- list | grep logwatch

but nothing shows

i also check running process

One Process of Logwatch Runnnig

can someone please guide more about this.

i can see that watchdog process is running but watchdog and logwatch have some connections
Attached Thumbnails
Click image for larger version

Name:	a.jpg
Views:	18
Size:	59.2 KB
ID:	20197   Click image for larger version

Name:	b.jpg
Views:	15
Size:	18.1 KB
ID:	20198   Click image for larger version

Name:	ca.jpg
Views:	15
Size:	72.7 KB
ID:	20199  
 
Old 12-01-2015, 10:54 PM   #2
berndbausch
Senior Member
 
Registered: Nov 2013
Location: Tokyo
Distribution: Redhat/Centos, Ubuntu, Raspbian, Fedora, Alpine, Cirros, OpenSuse/SLES
Posts: 3,492

Rep: Reputation: 921Reputation: 921Reputation: 921Reputation: 921Reputation: 921Reputation: 921Reputation: 921Reputation: 921
I would say you have NO logwatch process running. Watchdog seems to be a kernel process, no connection with logwatch.

Why don't you google for /var/cache/logwatch? This, for example, looks like a solution: http://www.scratchyourself.com/logwa...cache-tmp-conf.

EDIT: You should have a logwatch package on the system. To find out where its config and startup files are, run rpm -ql logwatch.

Last edited by berndbausch; 12-01-2015 at 11:09 PM.
 
Old 12-02-2015, 12:53 PM   #3
debguy
Member
 
Registered: Oct 2014
Location: U.S.A.
Distribution: mixed, mostly debian slackare today
Posts: 207

Rep: Reputation: 19
> we have found that data is increasing in /var/cache/logwatch folder on daily basis

that's of course halarious because you want logging to be preened so it does not crash the system, and the (preening program) is creating logs that will eventually crash the system !
 
Old 12-02-2015, 12:55 PM   #4
debguy
Member
 
Registered: Oct 2014
Location: U.S.A.
Distribution: mixed, mostly debian slackare today
Posts: 207

Rep: Reputation: 19
$ ps ax

show a list of running process (that are not hidden by use of kernel hiding)

$ lsof

list all open files and sockets

see acct(1)
see sa(1)
see quota(1)

it would be hard to show a connection between watchdog and if it logs to a particular log preening program

rather /var/cache/logwatch may just be a filename, which if you are rigth watchdog uses, not a program

people run "log programs" to preen log files on a timed basis though not all log files are safe to preen - 99.9 are

i prefer chopping logs with "head -n m" on all files in /var/log and restart all loggers and any ornary program that needs restart to connect to looger: that simple, so there are no configurations, all under /var/log. Not incl /var/log/[ub]tmp. and any "growth files" not in /var/log and forced in there.

why is all log programs i've tried (one) had bugs and left me with overflows or more headaches than they solved.

by doing that i avoid quota and programs "panicing" because they can't write logs

Last edited by debguy; 12-02-2015 at 01:15 PM.
 
Old 12-02-2015, 01:12 PM   #5
debguy
Member
 
Registered: Oct 2014
Location: U.S.A.
Distribution: mixed, mostly debian slackare today
Posts: 207

Rep: Reputation: 19
wait ...

Oracle Linux Administrator's Guide for Release 6

https://docs.oracle.com/cd/E37670_01...h25s07s01.html

(which claims it's a report generator by email?, not a log preener - it does not chop logs it generates reports, which may accumulate if you say so)

shouldn't you be referring to your documentation rather than linuxquestions ?
 
Old 12-02-2015, 01:23 PM   #6
debguy
Member
 
Registered: Oct 2014
Location: U.S.A.
Distribution: mixed, mostly debian slackare today
Posts: 207

Rep: Reputation: 19
for example i tried "logrotate" which i liked

but it didn't always work left some logs accumulating

i spent time $$ configuring it, thought i was done

but i kept having to fix things ... create 0664 root : mail or some program barfs when it tries to use it's log. or some program barfs due to lack of access.

it has to run as root know know which log gets what perm, and programs tend to change that kinda thing; the logger would have to follow it, not be configured or told

? oh the new version after upgrade has different options ?

you see ? it's nice but there is always another problem.

chop them all easy, restart so loggers and programs have their pipes and open status correct, no problems except "waiting for restart" (some will like, some cannot do that)
 
Old 12-02-2015, 01:43 PM   #7
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 21,974

Rep: Reputation: 5831Reputation: 5831Reputation: 5831Reputation: 5831Reputation: 5831Reputation: 5831Reputation: 5831Reputation: 5831Reputation: 5831Reputation: 5831Reputation: 5831
Quote:
Originally Posted by debguy View Post
for example i tried "logrotate" which i liked

but it didn't always work left some logs accumulating i spent time $$ configuring it, thought i was done but i kept having to fix things ... create 0664 root : mail or some program barfs when it tries to use it's log. or some program barfs due to lack of access.

it has to run as root know know which log gets what perm, and programs tend to change that kinda thing; the logger would have to follow it, not be configured or told

? oh the new version after upgrade has different options ? you see ? it's nice but there is always another problem.
chop them all easy, restart so loggers and programs have their pipes and open status correct, no problems except "waiting for restart" (some will like, some cannot do that)
This is absolute nonsense. How, exactly, do you spend $$$ fixing a free program? And if your log files are configured correctly ONCE, you don't have to do it again, unless you didn't configure things correctly. Which, given your posts, seems very likely.
 
  


Reply

Tags
logwatch


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
I want to disable logwatch on our RHEL servers to stop the logwatch mail svik Linux - Enterprise 10 08-27-2009 02:51 PM
Does logwatch run automatically? How can I reset logwatch? abefroman Linux - Software 4 06-17-2009 02:17 AM
logwatch clpl1980 Fedora 5 12-05-2006 07:31 AM
LogWatch exyst Linux - Software 0 03-13-2004 06:04 PM
logwatch GraemeK Linux - Software 2 12-18-2003 08:32 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 08:56 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration