How to prevent logs from getting too big?
Usually you should only log the activity you care about and should configure the program to be less verbose if possible.
As suggested, using logrotate is the usual way of dealing with logfiles. But instead of adding content to /etc/logrotate.conf
you should add your own job to /etc/logrotate.d/
, otherwise you would have to look at more diffs of configuration files during release upgrades.
Here is an example I created for a php script:
/var/log/some-php-app/*.log {
daily
rotate 10
delaycompress
compress
notifempty
missingok
}
-
/var/log/some-php-app/*.log
- Is the path where the log file(s) is located and it's name. As you can see, you can also use wildcards to apply the rule to more than one logfile. - daily - Rotates logfiles daily. Alternatives: hourly, weekly, monthly, yearly, maxsize, maxage
- rotate count - Files are rotated count times before being removed or mailed to the address specified in a mail directive.
- delaycompress - Postpones compression of the previous log file to the next rotation cycle.
-
compress - Compresses old versions of log files with gzip. You can use
zless
instead ofless
to view the files. - notifempty - Does not rotate the log if it is empty.
- missingok - Goes on to the next rotate job without issuing an error message, when the log file is missing.
Have a look at the logrotate manpage for more options.
You will want to set a size in /etc/logrotate.conf
The file exists by default and is ran daily. The only thing you will need to do is add some additional parameters to logrotate.conf.
/path/to_big.log {
size 1k
create 700 user group
rotate 1
}
In this example we specify the path to our log,the size we want to limit it to, the permissions for the replacement log, and how many copies to keep. Rotate 1 will keep one copy.
If your logs are growing very fast you can't wait for cron to run logrotate once a day as is the default after setting the size limit as mentioned in the previous answer, you can make a symlink in /etc/cron.hourly to the logrotate cron job in /etc/cron.daily with this command:
sudo ln -s /etc/cron.daily/logrotate /etc/cron.hourly/
The only thing you need to remember, is to be sure and delete the link once the problem that is creating the excessive logs is resolved. That is if you have something outside of your control creating excessive logs, you need to report a bug about the problem, because it may be affecting others without realizing it. This kind of bug can cause the root volume to run out of space and then people will see all kinds of problems and never realize that it is because they are running out of space on root.