What is the best practice when some log files grow very fast and eating away the FS space.

Based on the log file name, in some cases we can use
# cat /dev/null > <logfile> - To initialize to zero.
In this case do I need to refresh the log daemon to start logging in again OR it's starts automatically?

Thanks,
srao01

If you're going to do things like this and just delete the log file why are you bothering to log in the first place?

You need a proper log and log rotation strategy, decide how often logs need rotated and how long to keep them and then use logrotate to do the rotation and compression.

1 members found this post helpful.

You're not deleting the log file, so there's no need to restart the daemon, but I agree with tentenths totally. If you're not going to READ/examine/use the log file, why have it at all??

I'd examine WHAT you're logging, to what level, and adjust it accordingly. I'd also use something to examine those files for error(s)/message(s) that are important to you, and have it notify you. Logrotate is a good program to use, and you can easily write a program/script to compress huge log files down to a MUCH smaller size.

1 members found this post helpful.

Don't worry about the contents of log, we normally take a backup OR preserve a copy on some other FS before initializing it. The TB0ne first sentence clarified the doubt.

Thanks,
srao01

Well why not just redirect the log to be sent to that other file system in the first place?

Another issue here is your incomplete question. Using the reveal method to ask your question and then adapt based on others' comments is not the best way to approach things.

logrotate is routinely used to compress log-files and to delete old archives on a rotating basis.

In some situations, e.g. where due to government regulations log-files cannot be destroyed, it is quite common to have "log storage farms," consisting of so-called Network-Attached Storage (NAS) of basically-unlimited size, with daemons that migrate the logs and carefully account for them.

And of course it should go without saying that you should be using LVM = Logical Volume Management to allow any mount-point to spread over multiple physical devices . . .