/var/log/messages gets bigger and bigger

1

Hello,
my logfile /var/log/messages gets bigger and bigger. The actual size is 156 GB and I am not able, to check my log, because it is too big. How can I prevent the logfile from growing without end? How can I check the entries? I tried to download it, but notepad++ can’t open very big files. Any idea?
Thank you
Jadokus

2

You should have a syslogd daemon running on your system (ps -ef | grep syslogd)

There is a /etc/logrotate.conf which rotates logs for 52 weeks.

You should have the most recent /var/log/messages and then a bunch of /var/log/messages.nn.gz

3

You can check the rotation with
logrotate -v /etc/logrotate.conf

1 Like
4

Thank you. The last rotation of messages has been on 27-12-2020, only four days ago. How is it possible, that it has grown so big? Do I only have to wait till the next rotation or can I force him to rotate?

5

Do you have the rotated files /var/log/messages.nn.gz, with nn=0…52 ?
You can force the rotation with -f option.

6

Happy New Year! Yes, there are rotated files. I did a logrotate -f and deleted the monster-file. Thank you!

7

Happy New Year!
Remains the question why the rotation isn’t done regulary.
How are the dates of the rotated files? Should be weekly, like this for example

-rw-rw-r-- 1 root syslogd 2.8M Dec 27 00:00 /var/log/messages.1.gz
-rw-rw-r-- 1 root syslogd 1.8M Dec 20 00:01 /var/log/messages.2.gz
-rw-rw-r-- 1 root syslogd 1.5M Dec 13 00:01 /var/log/messages.3.gz
-rw-rw-r-- 1 root syslogd 1.6M Dec 6 00:01 /var/log/messages.4.gz
-rw-rw-r-- 1 root syslogd 1.6M Nov 29 00:00 /var/log/messages.5.gz
-rw-rw-r-- 1 root syslogd 2.0M Nov 22 00:00 /var/log/messages.6.gz
-rw-rw-r-- 1 root syslogd 2.1M Nov 15 00:01 /var/log/messages.7.gz
-rw-rw-r-- 1 root syslogd 2.0M Nov 8 00:01 /var/log/messages.8.gz
-rw-rw-r-- 1 root syslogd 1.8M Nov 1 00:01 /var/log/messages.9.gz
-rw-rw-r-- 1 root syslogd 1.9M Oct 25 00:01 /var/log/messages.10.gz
-rw-rw-r-- 1 root syslogd 2.1M Oct 18 00:00 /var/log/messages.11.gz
-rw-rw-r-- 1 root syslogd 1.9M Oct 11 00:00 /var/log/messages.12.gz
-rw-rw-r-- 1 root syslogd 1.9M Oct 4 00:00 /var/log/messages.13.gz
-rw-rw-r-- 1 root syslogd 3.9M Sep 27 00:00 /var/log/messages.14.gz
-rw-rw-r-- 1 root syslogd 860K Sep 20 00:00 /var/log/messages.15.gz

8

Mine looks like BBs. Every seven days at or after midnight:

[root@ipfire log]# ls -alv mes*
-rw-rw-r-- 1 root syslogd 9873446 Jan  1 14:44 messages
-rw-rw-r-- 1 root syslogd 1111206 Dec 27 00:00 messages.1.gz
-rw-rw-r-- 1 root syslogd 1867963 Dec 20 00:01 messages.2.gz
-rw-rw-r-- 1 root syslogd 1859667 Dec 13 00:01 messages.3.gz
-rw-rw-r-- 1 root syslogd 2076817 Dec  6 00:00 messages.4.gz
-rw-rw-r-- 1 root syslogd 1704400 Nov 29 00:00 messages.5.gz
-rw-rw-r-- 1 root syslogd 1967163 Nov 22 00:01 messages.6.gz
-rw-rw-r-- 1 root syslogd 1490190 Nov 15 00:00 messages.7.gz
-rw-rw-r-- 1 root syslogd 2910449 Nov  8 00:00 messages.8.gz
-rw-rw-r-- 1 root syslogd 3682107 Nov  1 00:00 messages.9.gz
-rw-rw-r-- 1 root syslogd 8676911 Oct 25 00:01 messages.10.gz
-rw-rw-r-- 1 root syslogd 1184868 Oct 18 00:01 messages.11.gz
-rw-rw-r-- 1 root syslogd 1735120 Oct 11 00:00 messages.12.gz
-rw-rw-r-- 1 root syslogd  977943 Oct  4 00:00 messages.13.gz
9

In my post I asked if syslogd is running … did not get a reply.

[root@ipfire ~]# grep syslogd /var/log/messages
Dec 27 00:01:01 ipfire syslogd 1.5.1: restart (remote reception).