Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found out that few files seem to pile up in size using this command:

find / -size +50M

Most of them are log files, so I would like to know if it's safe to delete the log files. the log files in question are:

/var/log/httpd/mySite.com-access.log.1
/var/log/httpd/access_log.1
/var/log/httpd/mySite.com-access.log
/var/log/maillog.4.gz
/var/log/maillog 

The server os version is: cat /etc/centos-release CentOS release 6.2 (Final)

And if it is ok to delte - how do I do it? Do I just delete the file with rm, or should I "clear it's contents" by doing for example:

cat /dev/null > access_log.1 
share|improve this question
add comment

4 Answers

up vote 2 down vote accepted

Is it safe to delete them? Most likely yes. Some files such as you mail log you may just wish to concat them via cat /dev/null > somefile. Most often files ending in .1 have been rotated out by log rotate, check it's config file as well as often log rotate will delete older files as well. Thus often log files ending in .1 can be deleted.

Weather or not it is a good idea to delete the log files is a different issue all together. Depending on who's server this is and so forth there may be potential legal ramifications for deleting files you are obligated to keep for specified periods of time. If it is your server then it's good to keep the files for as long as you deem them necessary. However before deleting the files it is often good to have a look into some of them looking for commonly repeated message and or the phrases "error", "deny", and "abort".

share|improve this answer
    
You can do it without cat (in bash), with :>/path/to/logfile –  Tom O'Connor Jun 19 '12 at 11:35
    
Cool, learn something new every day :-) –  Red Tux Jun 19 '12 at 12:12
    
partmaps.org/era/unix/award.html always interesting for hidden bits of linux-command-fu –  Tom O'Connor Jun 19 '12 at 12:28
add comment

logrotate is normally set up by default to rotate weekly and keep 4 old logs. You can get more consistent space usage by changing this to daily and keeping 28 old logs. You are still retaining the same time period but now 26 out of the last 28 days will always be compressed rather than varying between 27 and 21 days as the week wears on. You can make this 27 out of the last 28 days by removing the delaycompress option in the logrotate config.

The configs for logrotate are in /etc/logrotate.d/. There's usually one file in there for each service that produces logs.

As far as deleting is concerned, it doesn't matter much for old log files that have already been rotated (the ones ending in .1 or .4.gz) but for log files that are being written to, using rm can cause an odd situation where the file doesn't exist in that directory any more but the process still has it open and is writing to it. You won't have freed up any disk space and you won't be able to get to the logs that are being written. Each service has a different method for notifying it that it should start a new log file and these are usually codified in the postrotate section of the logrotate config files.

share|improve this answer
add comment

If you don't need them (check really well if you do, there might have been errors, security breaches etc. in them), you can delete them. After deleting (or echoing "" into them), for safety, restart the service that produces those log files.

If you have constant issues with log file sizes, consider installing a "logrotate" implementation, which itself zips, archives and deletes log files after a specified amount of time.

share|improve this answer
add comment

Why delete log files at all?

If you're that starved for space, burn them to CD or DVD, or redirect them to a USB flash drive, so you'll at least have them somewhere if you need them.

share|improve this answer
1  
Fast forward 10 years when search teams are called in to climb over piles of CDs full of log files to search for the OP who has become lost... It's always best to have a data retention policy that include deleting data, this includes one's own personal life. :-) –  Red Tux Jun 19 '12 at 12:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.