logging - RHEL6 boot.log is GBs in size

06
2014-04
  • aries1564

    I am a novice linux user and I have inherited a RHEL6 server that is acting as a syslog-ng server. My problem is the boot.log is growing leaps and bounds from what appear to be the entries for the firewall going into the boot.log rather than the syslog messages file.

    My first concern is the absolutely massive size of the boot.log. What should be a very small file is over 8.1 GB and growing. I would like to rotate it or truncate it if need be. I read several items that indicate using logrotate is not appropriate for RHEL6. Is there another way to have this log rotate? My biggest fear is the server will be rebooted one day but fail due to this massive log.

    Thanks!

    • Answers
  • davidgo

    I suspect your hypothesis is wrong - logrotate works fine (and is installed by default) in RHEL6 - see here for official documentation. There would be alternative ways to rotate the log file (eg manually move it, touch the file and restart the service writing to it - probably syslogd or rsyslogd), but logrotate is the tool designed for the job. If you provide links to the discussion I might be able to clarify or debunk it - nothing came up in a quick Google search. (It may be that log entries can go missing if logrotate is invoked with certain parameters or somesuch, but the solution is to tweek the way logrotate does the rotation).

    Another thing to do is target the cause of the problem, and move the writing of the problem log to another file - normally by editing /etc/rsyslog.conf (or /etc/syslog.conf) and restarting it.


    • Related Question

    logging - keep log of ignored files using rsync --max-size option
  • ferro

    I'm using rsync to do some backups to an external harddrive which is formated has FAT32 so I need to ignore files bigger than 4GB, I know I can use --max-size=4GB (actually I don't know if the 4GB part is correct) but I would like to keep a log of the ignored files.


    • Related Answers
  • user46569

    i don't think rsync can explicitly log ignored files, but I might be wrong. you could always run:

    find /src/dir -type f -size +4G > /path/to/over4gb.log

    then you could take that log file and pass it to rsync via --exclude-from ..eg:

    rsync -av --exclude-from=/path/to/over4g.log /src/dir/ /dest/dir/

    just to be safe for your fat32 partition you might cut the size down to 3.8gb.. put it in a script or run it all at once:

    find /src/dir -type f -size +3896M > /path/to/over3.8g.log && rsync -av --exclude-from=/path/to/over3.8g.log /src/dir/ /dest/dir/