Log files

If the system runs a lot of data is written into log files found under /var/log. After a while this data will get too large and the question arises what to do? Deleting the individual files is possible but a clean professional solution should do the job automatically.

To archive the logs emerge logrotate. The configuration file is /etc/logrotate.conf. Under gentoo logrotate is started once a day using a cron job, see /etc/cron.daily/logrotate.cron, but this does not mean it archives daily, since there is the option weekly in the config file. Per default, logrotate creates once per week an archive and keeps the last 4 archives. Some packages create their own log files. Logrotate holds for those packets separate config files in the directory /etc/logrotate.d It can be run in at the command line as logrotate -fv /etc/logrotate.conf to see if it does its job correctly and last but not least see what files it produces. logrotate is a bit picky when it comes to permissions of the /var/log folder.

The system logger logs all kind of messages. There is also the kernel log daemon klogd.

/var/log/messages

/var/log/wtmp

/var/log/faillog

Check for size /var/log/messages can raise up significantly. Just delete it or better emerge logrotate when it is too big. Next power up there will be a new smaller one. Depending on the system logger you have other log file names.

/var/temp contains user data.

Additionally there can be many package specific logs in /var/log as /var/log/cups/page_log


Linurs startpage