10

I am using a kvm ubuntu 10.04 virtual machine to test some features of a kernel module. I grep through the /var/log files to observe the kernel messages about that module.

To start from a clean state, I remove log files containing older messages by executing rm -rf /var/log/* and then rebooting the virtual machine. However, after I reboot, the new log files still contain those old log messages. It takes about 5-6 cycles of deleting files and rebooting virtual machine to finally get rid of those log file messages.

Why is this happening? Is there an easier way to cleanup log files?

Improve this question
3
  • logrotate is the official linux software about deleting&rotating logs automatically.
    – Hanan
    Dec 25, 2011 at 22:44
  • I did not want to rotate. Just wipe them off.
    – contemplatingzombie
    Dec 25, 2011 at 22:51
  • 1
    Following seems to work for me: 1. rm -rf /var/log/* 2. dmesg -c 3. reboot Since this works, I think that the kernel reads the previous log messages while booting, keeps them in buffer and writes them to files once again while rebooting. If anyone knows more about the actual mechanism please update.
    – contemplatingzombie
    Dec 25, 2011 at 22:55

3 Answers 3

Reset to default
7

The easiest way to clean the old logs is not to remove them.

The best way to clean the logs up is either logrotate as Hanan N. Pointed out or:

find /var/log -type f -exec /bin/cp /dev/null {} \;

for each of the log files. I am not exactly sure which log entries you are referring to from the previous boot but if you want to have this cleared after the boot you can put the command above into /etc/rc.local script so all the logging is for after the boot.

Normally though you don't want to clear the logs away since they are your starting point in all troubleshooting.

Improve this answer
2
  • I think that 'cp' command would copy all logs over the last expanded filename... perhaps you meant: find /var/log/* -exec cp /dev/null {} \; ?
    – jjmontes
    Dec 26, 2011 at 11:06
  • @jjmontes Thank you. I couldn't come up with the find command at the time. :) But it would actually be changed to the way I edited
    – Karlson
    Dec 26, 2011 at 16:50
3

For what you are doing, it may be better to add an additional log file for kernel messages. Some log daemons will allow you to perform matches on the records being written, so that you only get the appropriate records in your file. You can then rotate, delete, or rename the files between runs. (If you don't reboot, you may need to send a HUP signal to the log daemon to get it to reopen its files.

There are also tools which will extract only new records from the log. The logtail utility from the logcheck package is one such utility. It can be run with an alternate offset file.

There are other tools which watch the logs for records matching a pattern and reporting them. One of these might work well for you.

Improve this answer
2

This appears to work fine (on Ubuntu LTS 14.04) by rotating your logs out to a clean log and then deleting the older log entries. It is similar to the cp /dev/null method, but I think it's cleaner. ymmv

logrotate --force /etc/logrotate.conf
find /var/log/ -name '*[0-5]*' -exec rm {} \;
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .