Ok I've had my box up for a about 3 weeks. My logs are already pretty damn big and I only gave 3GIGs total in /var/

/var/log/httpd/access_log 241MB
/var/log/httpd/access_log.1 976MB
/var/log/httpd/access_log.2 123MB
/var/log/httpd/access_log.3 6MB
/var/log/httpd/access_log.4 223kB


How do I go about wiping the logs? can I just del these files... or del the biggest one... I really have no idea what I'm doing. :stickout:

Also I have "Incremental" enabled in webalizer, does this mean my old stats will not be wiped out if I wipe my logs?


Thanks.

You might want to wait until webalizer processes the logs then delete them..

cp /dev/null /var/log/httpd/access_log

Originally posted by AcuNett
You might want to wait until webalizer processes the logs then delete them..

cp /dev/null /var/log/httpd/access_log


I have an hourly webalizer cron. (Incremental of course)


I jsut need to know how to safely clean out my logs.

Incremental just means that however often webalizer runs (you can check /etc/cron.d) it backs up the current log to access_log.X and starts a fresh log called access_log. If you want you can .tar.gz those files and store them remotely incase you ever need to look into a complaint of sorts that you receive. If you don't care to analyze ancient logs and inform the person filing the complaint that you will monitor that particular account in the future you can just erase old logs completely. You can do this by rm access_log.* In addition you can look in /var/log and you'll see logs for all of your other programs. If you ever want to wipe out the current log (for example if sshd has logging enabled but no process is set to make backups of the logs and start a fresh one so you end up with a massive log file) then you can do this: cat /dev/null > /path/to/logfile That will copy the contents of /dev/null (which is always empty) overtop of the current contents of the file.

---www.sekure.us---

Originally posted by pyoor
Incremental just means that however often webalizer runs (you can check /etc/cron.d) it backs up the current log to access_log.X and starts a fresh log called access_log. If you want you can .tar.gz those files and store them remotely incase you ever need to look into a complaint of sorts that you receive. If you don't care to analyze ancient logs and inform the person filing the complaint that you will monitor that particular account in the future you can just erase old logs completely. You can do this by rm access_log.* In addition you can look in /var/log and you'll see logs for all of your other programs. If you ever want to wipe out the current log (for example if sshd has logging enabled but no process is set to make backups of the logs and start a fresh one so you end up with a massive log file) then you can do this: cat /dev/null > /path/to/logfile That will copy the contents of /dev/null (which is always empty) overtop of the current contents of the file.

---www.sekure.us---



Thanks that helps me out! :)

I'm running RH8.

00webalizer is in my daily cron dir.... yet my logs are only roatated weekly (wich is not often enough for me at this point)

What do I have to do to get the logs to rotate bi weekly.... also.... what if there is no disk space left in my /var/ partition to ammend the log files..... will the server fail or will it continue working?

(I only have 3 gigs in this partitition and my logs are over 1.5Gig a week!)

my $0.02

first of all do not know anythink about webaliser

onto log files

deleting a log file while your webserver is running is a bad idea. Also it won't necessarly free up space under linux/unix if the file descriptor is still open (a running webserver would imply an open file descriptor)

an option you can do is flush your file (removes the contents and reduces size without affecting the file descriptor)

how to flush a file ?

under linux you can try the following ..
(test it first on non-essential files please)

suppose you have a file "/var/log/httpd/big.file" and you want to flush it's contents...

touch /tmp/f1.log
touch /tmp/f2.log
cat /tmp/f1.log /dev/null > /var/log/httpd/big.file > /tmp/f2.log # big.file is now flushed
rm /tmp/f1.log
rm /tmp/f2.log

f1 and f2 are simply intermediate files for the redirection.


I would recommend a script (call it nightly.work lets say)which does the following

1) stops webserver (apachectl stop)
2) copy (& tar.gz the copy) the log files
3) flush the current log file (as shown above)
4) start webserver (apachectl start)
5) run webalizer or whatever stats progeam over the copy data

(depending on how busy your webserver is and hence the size of the log files you would have a webserver downtime of a few seconds every day BUT your system performance would be improved for not having beasts of files lying around

you could then produce daily webaliser reports
(and you have compressed historical data as well


hope this helps

hololi

Thanks hololi. :beer:

with apache its probably better to

rotate the access log then simply hup the apache (apachectl restart).

If you use the mv commmand on a log file, apache until restarted will continue to dump into the renamed file !

This makes sure theres no holes or missing data.

Apachectl restart is little safer too since it doesn't kill any active sessions really.


man rotate <-- good command to learn

My log files are rotating on a weekly basis... Wich config file contains these settings? I'd like to change it to bi weekly rather than having a cron wipe the files. I could take the log that was rotated it out and move it to a Partition with more space.

depends on how they are being rotated now.

if theres a cron job doing it on a weekly basis you could simply change the cron settings to do it bi-weekly.

If its running (Bsd'ish) out of the weekly.local script you might move it to a real cron.

Hard to guess your config man.