1

I have a RHEL server that has /var mounted inside an LVG on its on dedicated LV. Per RH Security Advisory CCE-26215-4 I needed to migrate /var/log to its own dedicated partition. So I shrunk /opt to reclaim space,(/opt was in the same LVG) then created a new LV for /var/log out of that space in the same LVG. Once I mounted it by adding it into /etc/fstab, I can no longer see all of the data that was there before.

Before:

-rw-------. 1 root   root      2368 Sep 16 10:50 anaconda.ifcfg.log
-rw-------. 1 root   root     39140 Sep 16 10:50 anaconda.log
-rw-------. 1 root   root     44009 Sep 16 10:50   anaconda.program.log
-rw-------. 1 root   root    387794 Sep 16 10:50 anaconda.storage.log
-rw-------. 1 root   root    111921 Sep 16 10:50 anaconda.syslog
-rw-------. 1 root   root     30216 Sep 16 10:50 anaconda.xlog
-rw-------. 1 root   root     69879 Sep 16 10:50 anaconda.yum.log
 drwxr-x---. 2 root   root      4096 Oct  2 06:48 audit
-rw-r--r--  1 root   root      2964 Oct  2 15:22 boot.log
-rw-------  1 root   utmp         0 Oct  1 03:34 btmp
-rw-------. 1 root   utmp      4608 Sep 21 08:47 btmp-20151001
drwxr-xr-x. 2 root   root      4096 Sep 16 10:54 ConsoleKit
-rw-------  1 root   root    126720 Oct  2 15:22 cron
-rw-------. 1 root   root     87635 Sep 20 03:33 cron-20150920
-rw-------  1 root   root    160346 Sep 27 03:09 cron-20150927
drwxr-xr-x. 2 lp     sys       4096 Jun 10 11:41 cups
-rw-r--r--  1 root   root     66463 Oct  2 15:22 dmesg
-rw-r--r--  1 root   root     66463 Oct  2 14:40 dmesg.old
-rw-r--r--. 1 root   root    355634 Sep 16 17:23 dracut.log
drwx------  2 root   root      4096 Aug 18 01:01 httpd
-rw-r--r--. 1 root   root    146584 Oct  2 15:22 lastlog
-rw-------  1 root   root      2019 Oct  2 15:22 maillog
-rw-------. 1 root   root      1859 Sep 17 12:44 maillog-20150920
-rw-------  1 root   root     26200 Sep 22 08:57 maillog-20150927
-rw-r--r--. 1 root   root         0 Sep 16 10:52 mcelog
-rw-------  1 root   root   1079139 Oct  2 15:22 messages
-rw-------. 1 root   root    447188 Sep 20 03:33 messages-20150920
-rw-------  1 root   root    863216 Sep 27 03:09 messages-20150927
 drwxr-x---  4 nagios nagios    4096 Oct  2 15:23 nagios
 drwxr-xr-x. 2 ntp    ntp       4096 Apr 28 05:15 ntpstats
 drwxr-xr-x  4 nagios nagios    4096 Sep 18 15:04 pnp4nagios
 drwxr-xr-x. 2 root   root      4096 Sep 16 11:37 prelink
 drwxr-xr-x. 2 root   root      4096 Sep 27 03:09 rhsm
 drwxr-xr-x. 2 root   root      4096 Oct  2 00:00 sa
 drwx------. 3 root   root      4096 Apr 10 01:59 samba
 rw-------  1 root   root    372611 Oct  2 15:22 secure
 -rw-------. 1 root   root     22713 Sep 18 17:05 secure-20150920
 -rw-------  1 root   root    368374 Sep 27 03:08 secure-20150927
 -rw-------  1 root   root         0 Sep 27 03:09 spooler
 -rw-------. 1 root   root         0 Sep 16 10:48 spooler-20150920
 -rw-------  1 root   root         0 Sep 20 03:33 spooler-20150927
 drwxr-x---. 2 root   root      4096 Jun 22 04:14 sssd
 -rw-------. 1 root   root         0 Sep 16 10:47 tallylog
 -rw-rw-r--. 1 root   utmp     81792 Oct  2 15:22 wtmp
 -rw-------. 1 root   root     28674 Sep 30 09:11 yum.log

After:

-rw-r--r-- 1 root root  3016 Oct  2 14:49 boot.log
-rw------- 1 root root   872 Oct  2 15:10 cron
-rw-r--r-- 1 root root 66529 Oct  2 14:49 dmesg
 drwx------ 2 root root 16384 Oct  2 14:03 lost+found
-rw------- 1 root root  1946 Oct  2 15:10 maillog
-rw-r--r-- 1 root root     0 Oct  2 14:49 mcelog
-rw------- 1 root root 81842 Oct  2 15:17 messages
-rw------- 1 root root  1426 Oct  2 15:17 secure
-rw------- 1 root root     0 Oct  2 14:49 spooler
-rw-rw-r-- 1 root utmp  3456 Oct  2 14:50 wtmp

I don't think its a space constraint because before the migration /var was at 685MB used and the new /var/log partition is 966MB total size and the contents on /log only total 35MB. I do not think its a user/perm issue as I am doing all this as root. Whats weird is I can umount it, reboot and everything in /var/log that I expect to see is there again.

Am I doing something wrong or is this just a side effect of LVM? Where is this data going when I mount it to the new LV?

5
  • 1
    The old /var/log was hidden under the new /var/log. Rename the old /var/log to /var/log-old.
    – ott--
    Commented Oct 2, 2015 at 21:11
  • Rename it when? Before I try to mount /var/log to the new volume? After? Can you elaborate on the steps?
    – user53029
    Commented Oct 2, 2015 at 21:44
  • 1
    Rename it before you mount the new /var/log.
    – ott--
    Commented Oct 2, 2015 at 21:46
  • Thats not working
    – user53029
    Commented Oct 2, 2015 at 21:59
  • 1
    This here may be the solution - unix.stackexchange.com/questions/205905/…
    – user53029
    Commented Oct 2, 2015 at 22:04

1 Answer 1

0

Copying should help, but other way, to receive all new log is to create directories structure same as on old logs dir, cause it not automatically created and some logs are missed(even new one not created)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .