Hello,

I would like to change the filesystem where log files will go (everything that goes into /var/log ).

When I installed Redhat, I didn't setup /var filesystem and now I would like it, but don't think its possible now as the /var directory is under the / filesystem. I worry about if there is a problem and logs fill up my root filesystem. Is there anyway to tell logs for messages, mail and secure to go in another filesystem if I create it? I would think there is some config file in /etc/ or something that tells where log files are put.

Any ideas are much appreciated.

Thanks!
Nigel

Yes you can do that by editing /etc/syslog.conf file. Look at the file and you will understand it. Restart the syslog service after modifying the file.

ahh..thats perfect...thank you!!!!

It's not only possible but also easy. Provided that you have space left for a new partition.

The basic steps are:

1. Create/format partition
2. Temporarily mount new partition, e.g. on /mnt
3. Move data from /var to /mnt
4. umount, then mount new partition on /var. (And edit /etc/fstab to mount automatically)

Make sure that you delete the old logfiles before remounting (POSIX file deletion semantics should let you do that without disrupting your system), so you don't end up with a bunch of large files (I've seen logs more than 10GB thick) that you can't access because the partition is mounted over the past var directory.