Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a linux server, I want to reduce the size of a log file which is several GB big. Cutting off the top half, or maybe the first million lines would work.

share|improve this question

4 Answers 4

up vote 8 down vote accepted

This comes up in interviews quite often...

Are you looking to truncate the file without disrupting the processes? Is any of the information in the log file valuable? If so, I usually "zero" the file with a simple bash string.

: > /var/log/badlogfile

This comes up in situations where you may have an application that can't be restarted in a controlled manner. Let's say it's a financial trading application and the program can't be halted or restarted during the trading day. However, the log files are growing at some obscene rate due to an application bug. Truncating the log files using the method above or below can keep the system running.

Also see: http://www.cyberciti.biz/faq/truncate-large-text-file-in-unix-linux/

share|improve this answer
1  
is the colon supposed to indicate a prompt, or does that actually go into the command? –  Phil Mar 26 '11 at 0:47
    
The colon is part of the command. –  ewwhite Mar 26 '11 at 0:55
    
That worked. Thanks. –  Phil Mar 26 '11 at 1:00
    
You don't actually need the colon. –  MikeyB Mar 26 '11 at 4:29
    
It's a no-op. It's not needed, but I like to keep it there when I make the recommendation. –  ewwhite Mar 26 '11 at 12:09

You could put it in logrotate, then it won't get out of control as easily

share|improve this answer
    
Ultimately that needs to happen. I'm new at this job... –  Phil Mar 26 '11 at 0:40

If it's actively being written to you don't really have much you can do by way of truncate. Your only options are to blank the file (you could copy it elsewhere first.)

echo "" >/var/log/fileYouWantToEmpty

That way the file ends up empty but is still the same file/inode so it won't disrupt the program that is logging.

share|improve this answer

You can also try cat /dev/null > /var/log/. But, i have to warn the /dev/null is not implemented in some of the older versions...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.