Operating System - Tru64 Unix
1748144 Members
3574 Online
108758 Solutions
New Discussion юеВ

Log cleaning of /var

 
k_75
Occasional Advisor

Log cleaning of /var

Hello to all,

I need to perform log cleaning activity on /var and /.

Can anyone suggest best practices to do it.
Are there any log files that are supposed to be archived/deleted in specified ways?
I have some 140 MB big /var/adm/messages log in production system. How do I trim it down?

Note: The ls output of /var/adm folder is follows. Please pur in your suggestions for maximum trim.

lrwxrwxrwx 1 root system 34 Aug 8 2001 acct -> ../cluster/members/{memb}/adm/acct
lrwxr-xr-x 1 root adm 43 Aug 8 2001 binary.errlog -> ../cluster/members/{memb}/adm/binary.errlog
lrwxr-xr-x 1 root adm 43 Aug 8 2001 collect.dated -> ../cluster/members/{memb}/adm/collect.dated
lrwxr-xr-x 1 root adm 35 Aug 8 2001 crash -> ../cluster/members/{memb}/adm/crash
lrwxr-xr-x 1 root adm 34 Aug 8 2001 cron -> ../cluster/members/{memb}/adm/cron
drwxr-xr-x 3 root system 8192 Aug 8 2001 dms
lrwxr-xr-x 1 root adm 37 Aug 8 2001 lastlog -> ../cluster/members/{memb}/adm/lastlog
lrwxr-xr-x 1 root adm 33 Aug 8 2001 lmf -> ../cluster/members/{memb}/adm/lmf
lrwxrwxrwx 1 root system 33 Aug 8 2001 lpd -> ../cluster/members/{memb}/adm/lpd
lrwxr-xr-x 1 root adm 38 Aug 8 2001 messages -> ../cluster/members/{memb}/adm/messages
drwxr-xr-x 3 root system 8192 Aug 8 2001 ris
lrwxrwxrwx 1 root system 36 Aug 8 2001 smlogs -> ../cluster/members/{memb}/adm/smlogs
lrwxr-xr-x 1 root adm 36 Aug 8 2001 syslog -> ../cluster/members/{memb}/adm/syslog
lrwxr-xr-x 1 root adm 42 Aug 8 2001 syslog.dated -> ../cluster/members/{memb}/adm/syslog.dated
lrwxr-xr-x 1 root adm 34 Aug 8 2001 utmp -> ../cluster/members/{memb}/adm/utmp
lrwxr-xr-x 1 root adm 34 Aug 8 2001 wtmp -> ../cluster/members/{memb}/adm/wtmp
lrwxrwxrwx 1 root adm 38 Aug 8 2001 fee -> ../cluster/members/{memb}/adm/acct/fee
lrwxrwxrwx 1 root adm 40 Aug 8 2001 pacct -> ../cluster/members/{memb}/adm/acct/pacct
lrwxrwxrwx 1 root adm 40 Aug 8 2001 qacct -> ../cluster/members/{memb}/adm/acct/qacct
drwxr-xr-x 2 root adm 8192 Sep 13 2001 versw
-rw-r--r-- 1 root adm 0 Mar 5 2002 verswclu_upgrade
drwxr-xr-x 2 root system 8192 Mar 5 2002 sendmail
drwxr-xr-x 3 root system 8192 Mar 5 2002 sysman
-rw-r--r-- 1 root system 2485 Mar 6 2002 cdsl_admin.inv
drwxr-xr-x 6 root adm 8192 Mar 6 2002 manual_patch
drwxr-xr-x 7 root adm 8192 Mar 6 2002 patch
-rw-r----- 1 root adm 77601 Apr 6 2004 messages.0
-rw-r----- 1 root adm 40288 May 18 2004 messages.1
-rw-r----- 1 root adm 149723 Oct 14 12:20 messages.bkp.141005
-rw-r--r-- 1 root adm 186 Nov 16 13:54 cdsl_check_list.old
-rw-r--r-- 1 root adm 186 Nov 16 13:54 cdsl_check_list




PS: Please have a look at attachment for ls output if it looks cluttered on query screen.
6 REPLIES 6
AwadheshPandey
Honored Contributor

Re: Log cleaning of /var

Hello k,

u can clear logs and messages, there are some crash dumps in /var/adm/crash, keep latest and remove them all, same on messagess but this is the file that u can not delete, just try with # tail -200 messages > messagess, this will decrease size of messagess, same for binary.errlog, u can see this file is too large and take much space, #> binary.errlog, u can also check space from #du /dirname, for which file is taking much space. find any core files and delete them,
# find / -name core -exec rm {}\;

one more thing remove all messagess.0, .1.bkp.141005 files eating ur space.

Cheers,

Awadhesh
It's kind of fun to do the impossible
Han Pilmeyer
Esteemed Contributor

Re: Log cleaning of /var

Actually I don't see the evidence in that "ls" output of the 140 MB. You can just truncate the messages log file. Afterwards you should stop and start syslog (using /sbin/init.d/syslog).

/var/adm/manual_patch is not a normal directory. Perhaps the /var/adm/patch directory eats up the space.
Venkatesh BL
Honored Contributor

Re: Log cleaning of /var

There is a '/usr/lbin/logclean' script entry in cron. Not sure if that would help.
k_75
Occasional Advisor

Re: Log cleaning of /var

Thanks guys.

I also have >1 GB of files in /var/audit directory.
These files are listed as:

auditlog..011
.
.
auditlog..020
auditlog..023

Is it safe to delete them? If not, what is the best way to archive them?

If I could free up this much of space, it'd very useful.
Ivan Ferreira
Honored Contributor

Re: Log cleaning of /var

You can delete de audit log that is not in use, verify with fuser.

Also, you should verify if there are some accounts that does not read their mail in /var/spool/mail. Files in that directory can grow too much if mail is not checked.
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Aco Blazeski
Regular Advisor

Re: Log cleaning of /var

About binary.errorlog, from my experience, I think that is safer first to stop binlogd, empty binary.errorlog, and then start again binlogd, that is:

#/sbin/init.d/binlog stop
# > /var/adm/binary.errlog
#/sbin/init.d/binlog start

Regards,

p.s. binary.errorlog contains useful information, so maybe is good idea to zip old binary.errorlog