I need to migrate /var/log/ and /var/log/audit to separate partitions. Currently the entire /var/ directory is on a logical volume with ample space (45G).
LVM is the partition type, so you meant migrate to new logical volumes, right?
I understand how to shrink and create new logical volumes (and the associated risks of resizing and need for full backups beforehand).
Won't touch that, then.
My question may be a simple one. How am I able to have /var/log/ on partition "B" if I've already mounted /var/ to partition "A"?
Again, you meant volume, not partition, right?
Stop system logging and auditing and anything else writing to
/var/log/audit directories. Create a TAR archive of the directories,
This sounds like a DoD system to which you are applying a STIG. If so, keep your SELinux attibutes and any other ACLs and extended attributes with something like this:
tar --selinux --acls --xattrs -cvf var_log.tar /var/log.
Shrink the logical volume holding
/var/ by as much as you want for the space you need in
/var/log/audit. Then create two new logical volumes, one for
/var/log and one for
/var/log/audit. Format the new volumes.
Optionally remove the data from the existing
/var/log/audit directories. Mount the new volumes in
/var/log/audit. Unpack the TAR archives to restore the system logging and accounting data. Start system logging and accounting services.
Add these new volumes to