3

I need to migrate /var/log/ and /var/log/audit to separate volumes. Currently the entire /var/ directory is on a logical volume with ample space (45G). I understand how to shrink and create new logical volumes (and the associated risks of resizing and need for full backups beforehand).

My question may be a simple one. How am I able to have /var/log/ on volume "B" if I've already mounted /var/ to volume "A"?

1 Answer 1

4

I need to migrate /var/log/ and /var/log/audit to separate partitions. Currently the entire /var/ directory is on a logical volume with ample space (45G).

LVM is the partition type, so you meant migrate to new logical volumes, right?

I understand how to shrink and create new logical volumes (and the associated risks of resizing and need for full backups beforehand).

Won't touch that, then.

My question may be a simple one. How am I able to have /var/log/ on partition "B" if I've already mounted /var/ to partition "A"?

Again, you meant volume, not partition, right?

Stop system logging and auditing and anything else writing to /var/log and /var/log/audit directories. Create a TAR archive of the directories, /var/log and /var/log/audit.

This sounds like a DoD system to which you are applying a STIG. If so, keep your SELinux attibutes and any other ACLs and extended attributes with something like this: tar --selinux --acls --xattrs -cvf var_log.tar /var/log.

Shrink the logical volume holding /var/ by as much as you want for the space you need in /var/log and /var/log/audit. Then create two new logical volumes, one for /var/log and one for /var/log/audit. Format the new volumes.

Optionally remove the data from the existing /var/log and /var/log/audit directories. Mount the new volumes in /var/log and /var/log/audit. Unpack the TAR archives to restore the system logging and accounting data. Start system logging and accounting services.

Add these new volumes to /etc/fstab.

4
  • Will I need to list the new volumes in /etc/fstab in any particular order?
    – a coder
    May 27, 2015 at 17:33
  • I suspect that order does matter, but I do not know the truth about it. Myself, I do certainly list them in the order that they should be mounted: for this, the first in the list is /var and then the others follow below /var May 27, 2015 at 17:43
  • Ok this works nicely. I added /var/log/ and /var/log/audit/ in sequence under /var/ in fstab - no issues. Thanks for the response.
    – a coder
    May 27, 2015 at 20:00
  • link to STIG has moved
    – Rich
    Feb 6, 2020 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .