Nagios Support Forum

Team,

/var reached more tham 80% now. I see that access_log is consuming more space 6.6 GB out of 12 GB of /var partition.
Please let us know whether we can trim any access_log files to reduce space.

[root@nagiosp01 httpd]# df -h /var
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/rootvg-var 12G 8.9G 2.2G 81% /var
[root@nagiosp01 httpd]#

[root@nagiosp01 httpd]# pwd
/var/log/httpd
[root@nagiosp01 httpd]# ls -lh
total 6.6G
-rw-r--r-- 1 root root 1.3G Feb 7 07:27 access_log
-rw-r--r-- 1 root root 1.8G Feb 2 04:05 access_log.1
-rw-r--r-- 1 root root 1.7G Jan 26 04:06 access_log.2
-rw-r--r-- 1 root root 80M Jan 5 04:05 access_log.2.gz
-rw-r--r-- 1 root root 1.6G Jan 19 04:05 access_log.3
-rw-r--r-- 1 root root 81M Jan 12 04:05 access_log.3_27.1.2020.gz
-rw-r--r-- 1 root root 52M Dec 29 04:05 access_log.3.gz
-rw-r--r-- 1 root root 9.6M Feb 7 07:26 error_log
-rw-r--r-- 1 root root 14M Feb 2 04:05 error_log.1
-rw-r--r-- 1 root root 13M Jan 26 04:06 error_log.2
-rw-r--r-- 1 root root 9.2M Jan 19 04:05 error_log.3
-rw-r--r-- 1 root root 16M Jan 12 04:05 error_log.4
-rw-r--r-- 1 root root 1.9M Feb 6 18:50 ssl_access_log
-rw-r--r-- 1 root root 3.2M Feb 2 00:38 ssl_access_log.1

Yes, these can be deleted as needed. You can also set up logrotate to automatically handle them. For httpd logs see /etc/logrotate.d/httpd and for all logs see /etc/logrotate.conf.

Can you help me what these logrotate are and how we have to manage them. Below are the details of the file details provided by you.

[root@nagiosp01 ~]# cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
minsize 1M
create 0664 root utmp
rotate 1
}

/var/log/btmp {
missingok
monthly
minsize 1M
create 0600 root utmp
rotate 1
}

# system-specific logs may be also be configured here.
[root@nagiosp01 ~]# ll /etc/logrotate.d/httpd
-rw-r--r-- 1 root root 167 Sep 27 2013 /etc/logrotate.d/httpd
[root@nagiosp01 ~]# cat /etc/logrotate.d/httpd
/var/log/httpd/*log {
missingok
notifempty
sharedscripts
postrotate
/sbin/service httpd reload > /dev/null 2>/dev/null || true
endscript
}
[root@nagiosp01 ~]#

Yes, these can be deleted as needed

Just need to double check check with you for confirmation before I do any changes.
Which one I have to delete and which one I have to truncate to reduce space ?
Now the space utilization reached 89%. Below are the details.

[root@nagiosp01 ~]# cd /var/log/httpd
[root@nagiosp01 httpd]# df -h .
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/rootvg-var
12G 9.8G 1.3G 89% /var
[root@nagiosp01 httpd]#
[root@nagiosp01 httpd]# ls -lh
total 7.5G
-rw-r--r-- 1 root root 544M Feb 11 07:19 access_log
-rw-r--r-- 1 root root 1.7G Feb 9 04:06 access_log.1
-rw-r--r-- 1 root root 1.8G Feb 2 04:05 access_log.2
-rw-r--r-- 1 root root 80M Jan 5 04:05 access_log.2.gz
-rw-r--r-- 1 root root 1.7G Jan 26 04:06 access_log.3
-rw-r--r-- 1 root root 81M Jan 12 04:05 access_log.3_27.1.2020.gz
-rw-r--r-- 1 root root 52M Dec 29 04:05 access_log.3.gz
-rw-r--r-- 1 root root 1.6G Jan 19 04:05 access_log.4
-rw-r--r-- 1 root root 3.7M Feb 11 07:19 error_log
-rw-r--r-- 1 root root 12M Feb 9 04:06 error_log.1
-rw-r--r-- 1 root root 14M Feb 2 04:05 error_log.2
-rw-r--r-- 1 root root 13M Jan 26 04:06 error_log.3
-rw-r--r-- 1 root root 9.2M Jan 19 04:05 error_log.4
-rw-r--r-- 1 root root 1.4M Feb 10 19:11 ssl_access_log
-rw-r--r-- 1 root root 2.9M Feb 8 16:21 ssl_access_log.1
-rw-r--r-- 1 root root 3.2M Feb 2 00:38 ssl_access_log.2
-rw-r--r-- 1 root root 9.6M Jan 26 04:05 ssl_access_log.3
-rw-r--r-- 1 root root 9.1M Jan 18 16:21 ssl_access_log.4
-rw-r--r-- 1 root root 33K Feb 10 16:22 ssl_error_log
-rw-r--r-- 1 root root 1011K Feb 8 16:21 ssl_error_log.1
-rw-r--r-- 1 root root 1.1M Feb 1 16:21 ssl_error_log.2
-rw-r--r-- 1 root root 2.1M Jan 26 03:51 ssl_error_log.3
-rw-r--r-- 1 root root 50K Jan 18 16:21 ssl_error_log.4
-rw-r--r-- 1 root root 1.4M Feb 10 19:11 ssl_request_log
-rw-r--r-- 1 root root 3.1M Feb 8 16:21 ssl_request_log.1
-rw-r--r-- 1 root root 3.4M Feb 2 00:38 ssl_request_log.2
-rw-r--r-- 1 root root 11M Jan 26 04:05 ssl_request_log.3
-rw-r--r-- 1 root root 9.3M Jan 18 16:21 ssl_request_log.4
[root@nagiosp01 httpd]#

LGaddam,

Logrotate is a standard linux package, so you might want to read up on how it works in general. The linuxconfig website has a nice article on this, which you may find helpful:
https://linuxconfig.org/setting-up-logr ... dhat-linux

To answer your question a bit more, the logs you're concerned about aren't used by Nagios directly--they're just logs you can use to see the status of the webserver that serves the Nagios interface. You can safely delete or truncate any of them without causing a problem.

As you'll understand from your research on logrotate, older files get rotated to a .1, .2, .3, or .4 under your current configuration. I would start with deleting the .3 and .4 files to free up space.

If you continue to have your logs fill up like this, you might consider changing your log rotation interval and count. Currently, you're rotating weekly, and keeping 4 weeks. You could change to daily and keep 10 days, which might help keep space under control, while still giving you plenty of time to review your logs if you needed to.

You could accomplish that by editing your logrotate.conf to look like this at the top:

# rotate log files daily instead of weekly
#weekly
daily

# keep 10 days rather than 4 weeks worth of backlogs
#rotate 4
rotate 10

# create new (empty) log files after rotating old ones
create


After making that change, you can either wait for cron to come around and trigger the log rotation (which it does once a day), or you can force it to happen now, with this command:
[root@nagiosp01 ~]# logrotate -f /etc/logrotate.conf

I hope you find this to be helpful!

Additionally, these logs are really just informational/historical, all of the logs that end in .1, .2, .3, .4 are not current logs and can be moved or deleted (not recoverable)

Thanks for the information. Really helpful.
I have truncated for now 3 & 4 to reduce the space. Daily one suits good to have control. We will take care.

Ypou can lock the thread. Many Thanks.

lgaddam wrote:Thanks for the information. Really helpful.
I have truncated for now 3 & 4 to reduce the space. Daily one suits good to have control. We will take care.

Ypou can lock the thread. Many Thanks.

great!

Locking