Extra Large Log Files

Question: One of my Linux system log files has suddenly become very large (several hundred megabytes). What should I do?

Answer: The first thing to find out is what exactly is happening in the log files. To see the latest log activity for your web server error log, for example, you would run:

tail -f /var/log/httpd/error.log

If the file is expanding, you should see errors popping up. When you are finished looking at it, press CTRL-C.

The next step is to fix whatever error you are receiving. If it is enough to fill up several megabytes or even a gigabyte of log space, it is a recurring error that should be fixed. For a web server, repeated failed connections could be some type of denial of service (DoS) attack. For a mail server, numerous open connections could mean that someone is using your server to send spam. The key is to find out exactly what the root cause is and then fix it. If you want to clear the log file, run:

> /var/log/httpd/error.og

Your logs will be back to normal size once your server is running normally again.

Enabling bootlogd on Debian Linux servers

Question: I am concerned about some services loaded during my Linux server’s boot up, but it does not seem to keep any log of it. How do I fix this?

Answer: If you are running a Debian-based server, boot-logging is disabled by default. The only way to find out what is happening during a boot, other than being at the console and watching it happen, is to enable bootlogd.

Using a text editor (such as vi or nano), edit the file /etc/default/bootlogd as root.

Find the line that has “BOOTLOGD_ENABLE” and change “no” to “yes”.

BOOTLOGD_ENABLE=yes

Once you have rebooted, you should now have information in /var/log/boot about your system’s booting process.

The /var directory in Linux

In previous posts, we covered the Linux file and directory structure. One very important directory in Linux is /var. This directory general contains the following subdirectories:

1. backups – primarily used by APT, this directory contains backups of package update states.
2. cache – certain applications use this directory to store temporary files.
3. lib – another library directory, much like /usr/lib
4. log – a storage directory for log files, both current and past.
5. mail – many mail servers, such as Postfix and Sendmail will use this directory.
6. opt – Used for various applications depending on distributions
7. spool – where your mail server stores mail before it is delivered.
8. lock – some applications will lock files and store them here.
9. tmp – storage of temporary files
10. www – Apache HTTP Server will use this for the web servers default directory, although virtual web servers may be stored elsewhere.