1

I had an issue with /var running low on space despite it only appearing to have only 2 gigs of files allocated on the 5 gig partition. I determined the issue was that /var/log/messages was deleted but still open by rsyslog and was at 2.88 gigs.

I was able to resolve the issue for now by restarting rsyslog, thus releasing the 2.8 gig file to be properly deleted. However, I want to know how it got into this state to being with. Shouldn't rsyslog be automatically rotating files to prevent the log growing indefinitely? Is there something I can do to prevent this from happening again in the future?

2

The way this is supposed to work on a lot of distros is through logrotate, which is called from cron or a systemd timer every day. Logrotate looks for its configuration, e.g., in /etc/logrotate.d. As an example, on Debian you'd find /etc/logrotate.d/rsyslog, which rotates /var/log/messages (and a lot of other logfiles), here is an excerpt:

/var/log/messages
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                /usr/lib/rsyslog/rsyslog-rotate
        endscript
}

After it rotates the files, it tells rsyslog to close the old log file (what you did by restarting rsyslog) by running /usr/lib/rsyslog/rsyslog-rotate, which sends a SIGHUP to rsyslogd. The daemon will close the files when it gets SIGHUP without restarting; see the “Signals” section of the rsyslogd(8).

1

Use logrotate

a quote from the man page

logrotate reads everything about the log files it should be handling from the series of configuration files specified on the command line. Each configuration file can set global options (local definitions override global ones, and later definitions override earlier ones) and specify logfiles to rotate. A simple configuration file looks like this:

# sample logrotate configuration file
compress

/var/log/messages {
    rotate 5
    weekly
    postrotate
        /usr/bin/killall -HUP syslogd
    endscript
}

The next section of the config files defined how to handle the log file /var/log/messages. The log will go through five weekly rotations before being removed. After the log file has been rotated (but before the old version of the log has been compressed), the command /sbin/killall -HUP syslogd will be executed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.