I am using a server owned by another company. I am getting close to my server's MB allocation. I asked them these questions, but I am suspicious of their non-answer because I know that they would rather sell me up to something larger.

I am wondering if one or more od these service ram hogs could be killed. One seems to have to do with multiple user logins. I have 3 users, all my own.

The service: console-kit-dae

The other one supposedly has something to do with enhanced logging.

The service: rsyslogd

Anyone know if either or both of these are completely necessary?

Thanks.

rsyslog is the system logging utility. You generally don't want to disable logging on a server. Otherwise you'll be flying blind and could be hacked or attacked but not even know it because you have logging disabled.

Thanks. I started looking at system logs and found a huge amount of data in three of them. I am going to set up a cron to empty them at least daily. This grabbed back about 10MB. The logs I looked at are (the ones indented were the worst):

> cat /dev/null > /var/log/auth.log
cat /dev/null > /var/log/syslog
cat /dev/null > /var/log/daemon.log
cat /dev/null > /var/log/kern.log
cat /dev/null > /var/log/lpr.log
> cat /dev/null > /var/log/mail.log
cat /dev/null > /var/log/user.log
> cat /dev/null > /var/log/mail.info
> cat /dev/null > /var/log/mail.warn
cat /dev/null > /var/log/mail.err
cat /dev/null > /var/log/news/news.crit
cat /dev/null > /var/log/news/news.err
cat /dev/null > /var/log/news/news.notice

Achtung! Alles turisten und nonteknischen lookenpeepers!

Das komputermaschine ist nicht für der gefingerpoken und mittengraben! Oderwise ist easy to schnappen der springenwerk, blowenfusen und poppencorken mit spitzensparken.

Ist nicht für gewerken bei dummkopfen. Der rubbernecken sightseeren keepen das cottonpicken händer in das pockets muss.

Zo relaxen und watschen der blinkenlichten.


"If you don't know what the damm thing does, leave the damm thing alone!"

Also ... I wouldn't erase those logs, either. I wouldn't touch 'em. You never know when you might need 'em, and c'mon ... it's only 10 megabytes. If that's pushing you close to their (obviously too-small) allocation, then the right thing to do is to "suck-up and pay more."

Sure, use logrotate to compress them. But, do not delete them.

Someday soon, someone's gonna need those logs, and they're gonna say, "hey, what fool set-up this cron job to erase them?!" When they in due time figure out "what fool" it actually was, you'll be packing your cube and turning-in your badge. So to speak. Don't go there.

Well, this server is mine only and is running only one service program, so I don't have to answer to anyone. My pocketbook doesn't currently allow for the increased cost of upgrading. The public service will simply have to be discontinued if it will not run with what it has now. These log are going to be toasted by me daily, period!

Which is a very bad idea, especially in the case of auth.log, since this is the central file in which all authentication attempts (read: anyone that connects to your machine or tries to do so) are logged. If by all means you really need the space, compress those logs and/or move them to a different machine.

I'll compress and attach the auth.log to an email and ship them to my local machine then before deleting. Thanks for your info.

Take a look at logrotate.

Logrotate is the way to go even if only you wish to keep the logs for a few days and have them compressed, rotate, and eventually discarded. Generally you do want to keep them around and look at them every once in a while. See my recent post in what is security for the average joe. In my post I provide you with specific scenarios where I used those logs.

Thanks, I'll give a look.