Best way to cleanup old files

[rferebee]

Good afternoon,

I'm hoping someone can help me. We're running into space issues in the /usr directory.

I'm not sure what I can delete and what I shouldn't touch. As you can see by the attached screenshot, there seems to be a lot of really old files in

/usr/local/nagiosxi/var

I appreciate your assistance as always.

[benjaminsmith]

Hi @Rferebee,

These log files are for troubleshooting and you can safely remove the old logs to free up space That said, logrorate is supposed to handle compression and archiving of these log files so this stays manageable. The configuration for this is found in /etc/logrotate.d/nagiosxi.

Is the cron service running?

Code: Select all

systemctl status crond

You can manually run logrotate in debug mode with the following command. Let me know if you get any errors.

Code: Select all

logrotate -d /etc/logrotate.d/nagiosxi

[rferebee]

Here's what I see in our version of the configuration file:

Code: Select all

root@nagiosxi:/etc/logrotate.d>cat nagiosxi
/usr/local/nagiosxi/var/*log {
    missingok
    notifempty
    size 5M
    su nagios nagios
    rotate 1
    compress
}

/usr/local/nagiosxi/var/xidebug.log {
    missingok
    notifempty
    size 100M
    create 0660 apache nagios
    su apache nagios
    rotate 1
    compress
}

/usr/local/nagiosxi/var/xidebug.log.backtrace {
    missingok
    notifempty
    size 100M
    create 0660 apache nagios
    su apache nagios
    rotate 1
    compress

Crond is active and running.

I will try to run the log task manually on our test server and get back to you. Thank you.

[rferebee]

I ran the log task manually and got the following error:

Code: Select all

root@nagiostest:/usr/local/nagiosxi/var>logrotate -d /etc/logrotate.d/nagiosxi
Ignoring /etc/logrotate.d/nagiosxi because the file owner is wrong (should be root).
Allocating hash table for state file, size 15360 B

Handling 0 logs

Currently the file owner is nagios, not root as the error indicates.

[rferebee]

I tried running it again as the nagios account and got better results, although the directory size didn't really shrink much:

Code: Select all

bash-4.2$ logrotate -d /etc/logrotate.d/nagiosxi
reading config file /etc/logrotate.d/nagiosxi
Allocating hash table for state file, size 15360 B

Handling 3 logs

rotating pattern: /usr/local/nagiosxi/var/*log  5242880 bytes (1 rotations)
empty log files are not rotated, old logs are removed
considering log /usr/local/nagiosxi/var/cleaner.log
  log needs rotating
considering log /usr/local/nagiosxi/var/cmdsubsys.log
  log needs rotating
considering log /usr/local/nagiosxi/var/dbmaint.log
  log needs rotating
considering log /usr/local/nagiosxi/var/deadpool.log
  log needs rotating
considering log /usr/local/nagiosxi/var/event_handler.log
  log needs rotating
considering log /usr/local/nagiosxi/var/eventman.log
  log needs rotating
considering log /usr/local/nagiosxi/var/feedproc.log
  log needs rotating
considering log /usr/local/nagiosxi/var/load_url.log
  log does not need rotating (log size is below the 'size' threshold)
considering log /usr/local/nagiosxi/var/nom.log
  log does not need rotating (log size is below the 'size' threshold)
considering log /usr/local/nagiosxi/var/perfdataproc.log
  log needs rotating
considering log /usr/local/nagiosxi/var/recurringdowntime.log
  log needs rotating
considering log /usr/local/nagiosxi/var/reportengine.log
  log does not need rotating (log size is below the 'size' threshold)
considering log /usr/local/nagiosxi/var/scheduledreporting.log
  log does not need rotating (log size is below the 'size' threshold)
considering log /usr/local/nagiosxi/var/snmptt_service_results.log
  log does not need rotating (log size is below the 'size' threshold)
considering log /usr/local/nagiosxi/var/sysstat.log
  log needs rotating
rotating log /usr/local/nagiosxi/var/cleaner.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/cleaner.log.1.gz to /usr/local/nagiosxi/var/cleaner.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/cleaner.log.0.gz to /usr/local/nagiosxi/var/cleaner.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/cleaner.log to /usr/local/nagiosxi/var/cleaner.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/cleaner.log.2.gz
error: error opening /usr/local/nagiosxi/var/cleaner.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/cmdsubsys.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/cmdsubsys.log.1.gz to /usr/local/nagiosxi/var/cmdsubsys.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/cmdsubsys.log.0.gz to /usr/local/nagiosxi/var/cmdsubsys.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/cmdsubsys.log to /usr/local/nagiosxi/var/cmdsubsys.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/cmdsubsys.log.2.gz
error: error opening /usr/local/nagiosxi/var/cmdsubsys.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/dbmaint.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/dbmaint.log.1.gz to /usr/local/nagiosxi/var/dbmaint.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/dbmaint.log.0.gz to /usr/local/nagiosxi/var/dbmaint.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/dbmaint.log to /usr/local/nagiosxi/var/dbmaint.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/dbmaint.log.2.gz
error: error opening /usr/local/nagiosxi/var/dbmaint.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/deadpool.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/deadpool.log.1.gz to /usr/local/nagiosxi/var/deadpool.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/deadpool.log.0.gz to /usr/local/nagiosxi/var/deadpool.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/deadpool.log to /usr/local/nagiosxi/var/deadpool.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/deadpool.log.2.gz
error: error opening /usr/local/nagiosxi/var/deadpool.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/event_handler.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/event_handler.log.1.gz to /usr/local/nagiosxi/var/event_handler.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/event_handler.log.0.gz to /usr/local/nagiosxi/var/event_handler.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/event_handler.log to /usr/local/nagiosxi/var/event_handler.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/event_handler.log.2.gz
error: error opening /usr/local/nagiosxi/var/event_handler.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/eventman.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/eventman.log.1.gz to /usr/local/nagiosxi/var/eventman.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/eventman.log.0.gz to /usr/local/nagiosxi/var/eventman.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/eventman.log to /usr/local/nagiosxi/var/eventman.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/eventman.log.2.gz
error: error opening /usr/local/nagiosxi/var/eventman.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/feedproc.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/feedproc.log.1.gz to /usr/local/nagiosxi/var/feedproc.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/feedproc.log.0.gz to /usr/local/nagiosxi/var/feedproc.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/feedproc.log to /usr/local/nagiosxi/var/feedproc.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/feedproc.log.2.gz
error: error opening /usr/local/nagiosxi/var/feedproc.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/perfdataproc.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/perfdataproc.log.1.gz to /usr/local/nagiosxi/var/perfdataproc.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/perfdataproc.log.0.gz to /usr/local/nagiosxi/var/perfdataproc.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/perfdataproc.log to /usr/local/nagiosxi/var/perfdataproc.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/perfdataproc.log.2.gz
error: error opening /usr/local/nagiosxi/var/perfdataproc.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/recurringdowntime.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/recurringdowntime.log.1.gz to /usr/local/nagiosxi/var/recurringdowntime.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/recurringdowntime.log.0.gz to /usr/local/nagiosxi/var/recurringdowntime.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/recurringdowntime.log to /usr/local/nagiosxi/var/recurringdowntime.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/recurringdowntime.log.2.gz
error: error opening /usr/local/nagiosxi/var/recurringdowntime.log.2.gz: No such file or directory
rotating log /usr/local/nagiosxi/var/sysstat.log, log->rotateCount is 1
dateext suffix '-20200916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /usr/local/nagiosxi/var/sysstat.log.1.gz to /usr/local/nagiosxi/var/sysstat.log.2.gz (rotatecount 1, logstart 1, i 1),
renaming /usr/local/nagiosxi/var/sysstat.log.0.gz to /usr/local/nagiosxi/var/sysstat.log.1.gz (rotatecount 1, logstart 1, i 0),
renaming /usr/local/nagiosxi/var/sysstat.log to /usr/local/nagiosxi/var/sysstat.log.1
compressing log with: /bin/gzip
removing old log /usr/local/nagiosxi/var/sysstat.log.2.gz
error: error opening /usr/local/nagiosxi/var/sysstat.log.2.gz: No such file or directory

rotating pattern: /usr/local/nagiosxi/var/xidebug.log  104857600 bytes (1 rotations)
empty log files are not rotated, old logs are removed
switching euid to 48 and egid to 982
error: error switching euid to 48 and egid to 982: Operation not permitted

rotating pattern: /usr/local/nagiosxi/var/xidebug.log.backtrace  104857600 bytes (1 rotations)
empty log files are not rotated, old logs are removed
switching euid to 48 and egid to 982
error: error switching euid to 48 and egid to 982: Operation not permitted

It left all sorts of old log files from 2017 and 2014 (which you can see in the initial screenshot I uploaded). Those are taking up a ton of space. Is there a command I could use to clean those up in one fell swoop?

[scottwilkerson]

probably the easiest way to get all the "old" non-current files would be

Code: Select all

rm -f /usr/local/nagiosxi/var/*.log-*

[rferebee]

That worked perfectly, thank you very much.

Is there anything else I can look at in terms of streamlining our environment? Seeing all those old files makes me think there are probably more hiding around.

If you can't think of anything then please go ahead and lock this thread.

[scottwilkerson]

That worked perfectly, thank you very much.

Is there anything else I can look at in terms of streamlining our environment? Seeing all those old files makes me think there are probably more hiding around.

If you can't think of anything then please go ahead and lock this thread.

That is the only location I can think of that I know there was missing rotation cleaning in the past.

Locking thread