Clear var log linux

Is there a proper way to clear logs?

I was wondering if there was a proper way to clear logs in general? I’m new to Ubuntu and I’m trying to set up Postfix. The log in question is /var/log/mail.log . I was wondering if there was a correct way to clear it, rather than me going in it and deleting all the lines and saving it. I find that sometimes errors don’t get written to it immediately after I clear the log and save it. Side note: I’m having trouble setting up Postfix and am trying to make it easier for me to read the logs hoping it can help me out, instead of having to scroll all the way down.

if you want to just see the end of the file then tail is your friend. tail /var/log/mail.log to display the last 5 lines. tail -f /var/log/mail.log to see all lines written to the end of the file.

9 Answers 9

That will truncate the log without you having to edit the file. It’s also a reliable way of getting the space back.

In general it’s a bad thing to use rm on the log then recreating the filename, if another process has the file open then you don’t get the space back until that process closes it’s handle on it and you can damage it’s permissions in ways that are not immediately obvious but cause more problems later on.

Yasar has a nice answer using truncate

Also if you are watching the contents of the log you might like to use the tail command:

Ctrl-C will break off the tailing.

/bin/csh (common for FreeBSD) would bail out this with «Invalid null command», meanwhile zsh (popular replacement for bash ) would wait EOF. See serverfault.com/a/381380/67675

how can I schedule it ? putting > syntax in crontab is not running as it may not be recognising it as a syntax

Rather than a proper way, I’d call it a when-can’t-free-space way 🙂 And not sure if it matters, but you might want to service syslog restart . See also this answer.

truncate /opt/package/logs/*.log --size 0 

Here all log files in the /opt/package/logs will become empty..

This is actually a very good answer, and really the only one that directly answers the question of if there’s a proper way to truncate logfiles. HOW it’s better than the other answers is that is doesn’t DELETE the logfile, it zeros the contents properly, thus permission errors and missing logfiles which cause some daemons to panic will not occur in this case.

Yes, there’s a proper way: You don’t clear logs at all. You rotate them. Rotation involves switching log output to a new file, under the same name, with the previous N log files kept under a set of N related filenames.

How one rotates logs depends from how one is writing them in the first place. This is an oft-overlooked point. Some of the answers here touch upon it at least, mentioning that some logging programs keep an open file descriptor for the log file, so just deleting the file won’t free up the space, or indeed even switch output to a fresh log file.

If the program writing the log file is multilog from the daemontools package, for example, then you don’t do anything to rotate the logs at all — no manual scripts, no cron jobs. Simply tell multilog that log output is to a directory, and it will itself maintain an automatically rotated and size-capped set of N log files in that directory.

If the program writing the log files is svlogd from the runit package, for another example, then much the same applies. You don’t do anything at all apart from point the tool at a directory. It will itself maintain an automatically rotated and size-capped set of N log files in that directory.

If you are using rsyslog to write log files, then the logging program can be told to stop after the log file reaches a certain size and run a script. You have to write the meat of the script, to actually rename the log file and delete old log files based upon total size constraints, but at least the logging program has closed the file and paused log writing whilst this is happening.

The old syslogd way of rotating logs, still expected by logging programs such as syslog-ng and as exemplified by tools such as logrotate mentioned by djangofan in another answer here, is somewhat more haphazard. One runs a cron job that periodically renames the log files, and restarts the logging daemon (using whatever daemon supervisor it is running under). The problem with this, of course is that it doesn’t enforce an overall size cap. On slow weeks one can get N very small daily log files, whereas on busy days one can get 1 very big log file that’s well over the size limit.

This is why later and better tools like multilog and svlogd have file size configuration options and actually check the log file sizes themselves, of course. The world has learned that polling the logs on a schedule with cron jobs, or even a logrotate daemon, leaves windows for the size to be wrong, and that the proper place to have these checks, and so rigourously enforce administrator-defined size caps so that one’s log files don’t ever swallow the partition that they are on, is in the program that is actually writing the files out in the first place.

Источник

How to cleanup a /var/log/journal in Linux

You may find your /var/log/journal directory taking up a lot of disk-space.

How do you go about removing, or deleting all these files under var log journal without the system complaining and falling over?

How to tell how much space is being taken?#

You can ask the journalctl command directly, using the —disk-usage argument:

It will report something like this:

Journals take up 3.9G on disk.

Fix: Option 1 (not ideal):#

Go and adjust its config under /etc/systemd/journald.conf , making sure to pay attention to the SystemMaxUse key; set this to something reasonable, like 50M perhaps.

At this point you can force a log rotation by issuing this command:

sudo systemctl kill --kill-who=main --signal=SIGUSR2 systemd-journald.service 

Remember to restart the systemctl process, like this:

sudo systemctl restart systemd-journald.service 

Fix: Option 2 (not recommended):#

You could always go and delete the offending /var/log/journal/** directory contents, but this is not the recommended way, as the system journal could be writing here, which will probably cause you bigger problems!

Fix: Option 3 (RECOMMENDED!):#

Simply run the following command to cleanup the /var/log/journal directory:

journalctl --vacuum-size=500M 

This will delete old log files until the directory reaches the threshold size stipulated, in our case, 500M.

It really is that easy to clear or clean up your var log journal!

Источник

Free up Disk Space – Clear Systemd Journal Logs in Ubuntu 20.04

Going to free up Ubuntu system disk space? Try clearing the systemd journal logs, it may free up a few GB of space.

By using the Disk Usage Analyzer tool, I found that /var/log/journal takes more than 4 GB system space in my Ubuntu 20.04.

Systemd has its own logging system called the journal, and the log files are stored in /var/log/journal. As long as I don’t need the logs for any debugging, it’s safe to delete these files. And following steps will show you how.

1. First open terminal from system app launcher, and you may run command to check out the current disk usage of all journal files:

2. If you decide to clear the logs, run command to rotate the journal files. All currently active journal files will be marked as archived, so that they are never written to in future.

3. Now clear the journal logs by choosing one of following commands:

Delete journal logs older than X days:

sudo journalctl --vacuum-time=2days

sudo journalctl --vacuum-size=100M

sudo journalctl --vacuum-files=5

4. You can also edit the configuration file to limit the journal log disk usage (100 MB for example).

Run command in terminal to edit the file via Gedit text editor:

sudo -H gedit /etc/systemd/journald.conf

When the file opens, un-comment (remove # at the beginning) the line #SystemMaxUse= and change it to SystemMaxUse=100M.

Save the file and reload systemd daemon via command:

Источник

How to Fix a Big /var/log/journal?

In Linux, the journal is part of the system which comprises all the information regarding kernel or boot messages, Syslog messages, etc., stored in the journal file. The centralized location is available in the “/var/log/” directory. The logs in that file make it huge sometimes, which needs to be cleaned up to have a smooth system performance (just like the cache).

In this post, we will demonstrate the possible solutions to deal with the huge size of the /var/log/journal. Let’s get into it:

• How to Clean Up /var/log/journal File?
• Method 1: Using the –vacuum-size Option of the journalctl Command
• Method 2: Using the –vacuum-time Option of the journalctl Command
• Method 3: Using the –vacuum-files Option of the journalctl Command

How to Clean Up /var/log/journal File?

The reason for the increase in the file size is that logs are not cleaned up. To check the overall space occupied by the “var/log/journal” file, use the below-stated command:

The output shows that the disk space occupied by the journal files is “472.1MB”. Now, let’s examine the methods to overcome the large journal log files.

Method 1: Using the –vacuum-size Option of the journalctl Command

The “–vacuum-size”is the option that is used for limiting the disk usage of journal files and will limit the size of the “/var/log/journal” file. For instance, the command provided below will limit the size of journal files to 100MB:

$ sudo journalctl --vacuum-size=100M

Limiting the size of the journal logs will stop more using space, but it will not delete the existing files.

Note: Only archived Files will be deleted to reduce the journal log size.

Restart the journal service to update the changes:

$ sudo service systemd-journald restart

Method 2: Using the –vacuum-time Option of the journalctl Command

The “–vacuum-time” is the option used for deleting the old journal files with time such as hours, days, and years. You can use this to clear your journal files. To do so, execute the below command in the terminal:

$ sudo journalctl --vacuum-time=5d

In our scenario, we have deleted the old journal logs for the last 5 days.

Then restart the journal service to activate the changes using the below command:

$ sudo service systemd-journald restart

Method 3: Using the –vacuum-files Option of the journalctl Command

The “–vacuum-files” is the option that is also used for deleting the old files in a journal. This option will clear the journal by limiting the number of files:

$ sudo journalctl --vacuum-files=2

The above command will reduce the number of files to 2 by deleting the old files.

Note: The “–vacuum-files” option will not delete the files that are currently active or in use.

Restart the journal service to apply the new changes:

$ sudo service systemd-journald restart

After that user can verify the journal for internal consistency:

Conclusion

To resolve the big size issue of “/var/log/journal” in Linux, reduce the size of the journal log files by using the “ sudo journalctl –vacuum-size=” and “sudo journalctl –vacuum-time=” command. After that, restart the journal service using the “sudo service systemd-journald restart” command and verify the journal for internal consistency by running the “journalctl –verify” command. This post has demonstrated the possible solutions to eliminate the large size of “/var/log/journal” in Linux.

Источник