SUMMARY: Large syslog file - best remedy?

From: Liz Bartlett (khyri@idyllmtn.com)
Date: Fri Apr 18 1997 - 14:45:55 CDT


Original query:
>A shortage of space on the root partition alerted me
>to the fact that I had a /var/log/syslog file of nearly
>7 Mb! It is no longer growing, however I am unsure of the
>best way to mv/rm it, and start over with a fresh file.
>I have this feeling that something is going to continue
>to grab hold of it, and refuse to free up the space on
>the disk.
>
>I would like to avoid rebooting if possible, so any pointers
>as to processes that will need to be killed/restarted or
>HUPed are welcomed.
>
>System details: Sun Sparc 2
> SunOS 4.1.3_U1

An early response from "Nicholas R LeRoy" <nleroy@norland.com>
proved to be the perfect solution:

>Easy one!
># cd /var/adm (or /var/log...)
># mv syslog syslog.crap or
># rm syslog
># kill -HUP pid_of_syslogd (self explanatory).
>
>Hup'ing syslogd causes it to re-open its log files. The 'mv' works
>'cause syslogd never closes the files, so when you mv it, it still has
>the file open'ed til you do the kill. Note that this will cause the
>disk space to not be free'ed up 'til you HUP syslogd, too (if you rm it).

----------------------------------------------------------------

Other, varied responses, which may or may not work as well
(my apolgies for not acknowleging future respondants - I think
I have more than enough for a summary already!):

>From: bryan@thunderbolt.mitre.org

>You *should* be able to just use the rm/mv commands on it (as root, of
course).
>That's what works for me.

-----------------------------------------------------------------

>From: cgates@fnoc.navy.mil (Craig Gates)

>Run /usr/lib/newsyslog.

-----------------------------------------------------------------

>From: Ted Marigomen <tmarigom@trimedia.scs.philips.com>

>Try cp /dev/null > /var/log/syslog to zero out the file. Or kill
>syslogd first, zero out the file, then restart syslogd.

-----------------------------------------------------------------

>From: Jonathan Loh <jloh@netjet.com>

>Well as you probably already know it's an ordinary text file. So just set
>up a cron job.

-----------------------------------------------------------------

>From: Gene C Van Nostern-EDS x4717 <gene@sherpa.com>

>mv /var/log/syslog /var/log/syslog.`date +"%y%m%d"` # or some such
>kill -HUP `cat /etc/syslog.pid`
>rm (or compress, or gzip) /var/log/syslog.`date +"%y%m%d"`
>
>syslogd _should_ be the only process hanging on to /var/log/syslog.
>kill -HUP'ing it makes it let go.
>
>You might try fashioning some some sort of rotatelog facility, and
>putting it in root's crontab. Alas, I don't have one handy (and I don't
>know your needs anyway), else I would've sent one along.

----------------------------------------------------------------

>From: Melanie Dymond Harper <mel@vanyel.herald.co.uk>

>Assuming you want to keep file's contents:
>
>1) copy file to somewhere else
>2) compress file
> (copied version)
>3) cat /dev/null > original version
>
>If you no longer want the contents of the original file, just
>cat /dev/null to it as in step 3.
>
>
>This is what I do with my unwanted log files, any road.

----------------------------------------------------------------------
Liz Bartlett*http://www.idyllmtn.com/~khyri/ 110 E. Wilshire Ave.#G-10
Idyll Mountain Internet*http://www.idyllmtn.com/ Fullerton, CA 92832
Virtual Dog Show Co-ordinator*http://www.dogshow.com/ (714) 526-5656
Tibetan Mastiff Web Site*http://www.tibetanmastiffs.com/
Mailing List Services for small, niche lists*http://www.mlists.com/
HTML Writers Guild Mentor/Apprentice Pgm. Manager*http://www.hwg.org/



This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:11:51 CDT