Oversized logs & what to do?

[modem]

Hey all,

I was going through doing regular maintanence on the server earlier and noticed my log files are starting to get pretty hefty in size. Not all of them are getting in the hundreds of megs or out of control, but they are getting close. However one log I have - maillog has reached a whopping 1.12 GIGABYTES in size!!

My question is, does DA go through and periodically delete the logs or clean them out? Or do I need to manually do that? The last thing I want to have is my server chocked to death by logs.

***************************
For example my 3 biggest logs look like:

/var/log/cron - 96.0 MB
/var/log/exim/mainlog - 84.7 MB
/var/log/maillog - 1.12 GB
/var/log/messages - 280.6

[nobaloney]

Log rotation is handled by a logrotate script. Start by letting us know your OS distribution, and also check to see if you've got a logrotate script in /etc/cron.daily.

Jeff

[modem]

Sorry about that, it's been one of those after holiday weekends where everything for everyone's I.T. breaks. :)

I'm running CentOS 3.x. Inside the cronjob list the following is showing being run as root:

/etc/cron.daily/yum.cron
/etc/cron.daily/rpm
/etc/cron.daily/slocate.cron
/etc/cron.daily/logrotate
/etc/cron.daily/makewhatis.cron
/etc/cron.daily/00-logwatch
/etc/cron.daily/tmpwatch
/etc/cron.daily/prelink

the other cron jobs are the obvious ones such as mrtg, task.queue, quotacheck, dataskq, etc.

I too thought DA had a logrotation script however I've noticed those logfiles piling up.

[jmstacey]

logrotate is the default to handle non-apache logs, such as mainlog.

Check logrotate.conf and make sure everything there looks alright and make sure cron is operating properly and executing it everday as it should.
/etc/crontab should have those jobs.

[modem]

The good news is that cron is working just fine. MRTG and webalizer are updating their information each evening as the crontab is telling them to do so.

However when opening up and looking at the /var/log/exim/mainlog file, I'm seeing entries date stamped from 1-1-06 on Sunday going all the way through 1-3-06. With the /var/log/maillog file (the 1gb file) I noticed it's full of connection/session ended activitity where it appears clients are connecting every minute for email, etc. Not that that is unusual, but I'm seeing dates as far back as Jan 3.

Any ideas here? crontab contains a cronjob for logrotate. Can I manually force logrotate to happen?

[nobaloney]

logrotate is controlled by a configuration file. Right now it's set to rotate these logs weekly. If that's not often enough for you, then make some changes to the configuration file.

I think. :)

Jeff

[modem]

I changed the logrotate.conf file to reflect daily changes rather than weekly as well as only to keep 2 weeks worth of backlogs. I'll check tomorrow and see what affect that has.

[Heuveltje]

Hi, ive read differnt places on this forum but have not found the answer:

i do NOT have logrotate in my cron.daily.
How to install?

Logfiles date back to april when i did a manual touch of the mainlog etc. files (which was about 4 G)

Can anyone give me some directions on how to install this logrotate function?

Thanx
Michiel

[nobaloney]

That depends on your OS Distribution.

I don't know of a distribution that doesn't install it by default; if I were you I'd find an expert at your OS :) .

Jeff