up vote 2 down vote favorite
share [g+] share [fb]

I need to erase all system logs etc. from a running Debian machine that's primarily running an Apache server.

Is it safe to remove all the files in /var/log without recreating (by touching?) any of them? I.e. will all the standard processes recreate automatically their log files, including with the correct default owner and permissions, if they discover suddenly that the log file is gone?

link|improve this question
50% accept rate
feedback

4 Answers

up vote 2 down vote

Some daemons won't be happy until you kill -HUP them so they know that their log file has changed (more particularly when it's a mv). You should know what their behavior is before you do this.

You should consider using mv, kill -HUP then shred the moved file (instead of cp or echo).

Also, you might want to read man 8 logrotate for further information.

link|improve this answer
Some daemons use syslog, some do not. It just depends. Killing something that syslog is writing usually is safe (it just spews another file) but killing something that is directly written by the daemon can be a hit-or-miss kind of thing. Gave a point for using shred; it may not be as fast as dd if=/dev/zero of=/var/log/someforgotten.log but it's far "safer". – Avery Payne Jul 8 '10 at 17:39
feedback
up vote 1 down vote

no, not really. Some log files will not be recreated by the processes writing to them. You might better blank the logfiles, like cat /dev/null > /var/log/

link|improve this answer
and is it safe to blank all of the files there? – GJ. Jun 27 '10 at 18:20
also, is there a single command I can use that will individually blank each file in the dir? – GJ. Jun 27 '10 at 18:21
for i in /var/log/*.log; do echo "" > $i; done – Pier Jun 27 '10 at 19:20
@Pier: You need to add *.gz and *.1 at least, plus whatever others there are. And you need to exclude directories, but possible include the files in them. find is your friend. – Dennis Williamson Jun 27 '10 at 19:57
@Dennis - no need to blank, just rm .[0-9] and *.gz|bz2 if you're trying to cover tracks. – Kyle Smith Jun 27 '10 at 20:12
show 1 more comment
feedback
up vote 0 down vote

It's usually best to zero them, as such:

cp /dev/null /var/log/logname

That way, if any running process has open file handles for logname, it will be able to keep writing to the file, blissfully ignorant that anything at all has occurred.

link|improve this answer
feedback
up vote 0 down vote

reputation too low for commenting, so I put it in an answer:

To blank each file in /var/log/ including subdirectories, you could issue

find /var/log/ -type f -exec cp /dev/null {} \;

(naturally this is untested)

I would assume yes, it is safe to blank them. However no one will be able to tell for sure without examining the list of logfiles in there or the applications that created them. Debian policy suggests that it should be safe but probably no one has tried.

If I were you, I would preserve a copy of the directory and check the system's functions afterwards. And not forget to remove the backup :)

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.