Just discovered that logrotate is not rotating our firewall log. So it's up to 12G in size.
I need to split up the file into smaller chunks and start manually rotating them so I can get things back on track.
However before I start splitting the firewall up, I need to stop the firewall from logging to the current firewall log file and force it to start logging to a new empty file. This way I'm not trying to split up or rotate a log file that is still constantly growing.
I tried to simply do this:
mv firewall firewall.old touch firewall
I expected to see the new empty firewall file to start growing in size, but no... the firewall.old is still be logged to.
Then I tried to start/stop iptables. No change. firewall.old is still the log file.
I tried to move it to another directory. That didn't help.
I tried to stop iptables, then change the filename and create a new firewall file and then start iptables again, but no change.
How do I stop the logging on this file and force it to start logging on a new file?