Syslog Files accumulating Searching for setting to delete old syslog files

English Install/Boot/Login
1

Hi

I noticed in my system that my root partition is getting full. I found a lot of old compacted syslogfiles.

Had a look at etc/sysconfig editor eg cron but could not find a setting which allows, say …to delete files older than a month.

Where and how could I influence this ? I deleted manually all syslog files older than a month. Approx 6GB

thanks and cheers

2

I do it through “logrotate”. The config file is /etc/logrotate.d/syslog. Read the man page for logrotate to get familiar with all the config options. You can set it up to rotate weekly or more and only keep X number of old log files.

3

Thanks
Found the file and downloaded the docs. Masses.

I suspect the setting is in my case

rotate 99;)

That looks like days. Could you please confirm, it would save me a lot of searching

Thanks

4

Retain 99 versions, not necessarily days.

5

Thanks for the warning.

Need to do some more searching to be save.

cheers

6 
#
# Please note, that changing of log file permissions in this
# file is not sufficient if syslog-ng is used as log daemon.
#
# It is required to specify the permissions in the syslog-ng
# configuration file /etc/syslog-ng/syslog-ng.conf as well.
#

# the firewall,acpid,NetworkManager log files
# are used by syslog-ng and rsyslog only, the
# other by all syslog daemons.
/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/log/acpid /var/log/NetworkManager {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

# used by all syslog daemons
/var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

# used by all syslog daemons
/var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 news news
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

I suspect “maxage 365” maybe the time the logfile(s) will be kept

Can anyone confirm

Thanks

7

All the directives are explained in the man page. Do “man logrotate”

8

Thanks ken_yap

That’s it

maxage count
              Remove rotated logs older than <count> days. The age is only checked if the logfile is to be rotated. The files  are
              mailed to the configured address if maillast and mail are configured.

Thanks for your help

Greetings from OZlol!

9

I just wonder if anyone else has encountered this issue.

10

On machines with insufficient space in /var.

Or perhaps some process is filling up your logs, some persistent generator of error messages, perhaps?

11

Well I did a fresh install of 11.3 and gave the root partition 20GB. Rest is standard.

I do however run the default kernel. Have you had a look in your system ?

I will check my laptop and my friends systems.

12 
$ sudo du -sh /var/log
175M    /var/log
$ df -h /var/log
Filesystem            Size  Used Avail Use% Mounted on
/dev/md0               24G   12G   11G  51% /

Not a problem here.

13

Laptop has the same settings but was only recently fresh 11.3 installed. I better have a look into the logfiles, maybe there is something not quite right.:\

I’ll keep you posted.

14

I have a lot (what is a lot?) of

Oct  7 09:18:46 192-168-1-2 kernel:  6999.682574] Info fld=0x2
Oct  7 09:18:46 192-168-1-2 kernel:  6999.682583] end_request: I/O error, dev sr0, sector 8
Oct  7 09:18:46 192-168-1-2 kernel:  6999.686032] Info fld=0x6
Oct  7 09:18:46 192-168-1-2 kernel:  6999.686040] end_request: I/O error, dev sr0, sector 24
Oct  7 09:18:46 192-168-1-2 kernel:  6999.689690] Info fld=0x6
Oct  7 09:18:46 192-168-1-2 kernel:  6999.689698] end_request: I/O error, dev sr0, sector 24
Oct  7 09:18:46 192-168-1-2 kernel:  6999.693152] Info fld=0xe
Oct  7 09:18:46 192-168-1-2 kernel:  6999.693160] end_request: I/O error, dev sr0, sector 56
Oct  7 09:18:46 192-168-1-2 kernel:  6999.696882] Info fld=0xe
Oct  7 09:18:46 192-168-1-2 kernel:  6999.696893] end_request: I/O error, dev sr0, sector 56
Oct  7 09:18:46 192-168-1-2 kernel:  6999.700362] Info fld=0x1e
Oct  7 09:18:46 192-168-1-2 kernel:  6999.700370] end_request: I/O error, dev sr0, sector 120
Oct  7 09:18:46 192-168-1-2 kernel:  6999.703786] Info fld=0x1e
Oct  7 09:18:46 192-168-1-2 kernel:  6999.703794] end_request: I/O error, dev sr0, sector 120
Oct  7 09:18:46 192-168-1-2 kernel:  6999.707299] Info fld=0x0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.707307] end_request: I/O error, dev sr0, sector 0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.710728] Info fld=0x0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.710736] end_request: I/O error, dev sr0, sector 0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.714366] Info fld=0x0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.714375] end_request: I/O error, dev sr0, sector 0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.717877] Info fld=0x0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.717885] end_request: I/O error, dev sr0, sector 0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.721496] Info fld=0x0
Oct  7 09:18:46 192-168-1-2 kernel:  6999.721505] end_request: I/O error, dev sr0, sector 0

Has that some thing to do with running Raid 1 ? when starting up the system ?

15

just found out that dev sr0 i/o error could have something to do with my non-existant floppy drive. So I took out my user details.

16

/dev/sr0 is the first CD/DVD drive. Some process is trying to access it continually.

17

I think that was a false positive. I will keep an eye on it.

Thanks for your help.