11

On a linux server, I want to reduce the size of a log file which is several GB big. Cutting off the top half, or maybe the first million lines would work.

4 Answers 4

13

This comes up in interviews quite often...

Are you looking to truncate the file without disrupting the processes? Is any of the information in the log file valuable? If so, I usually "zero" the file with a simple bash string.

: > /var/log/badlogfile

This comes up in situations where you may have an application that can't be restarted in a controlled manner. Let's say it's a financial trading application and the program can't be halted or restarted during the trading day. However, the log files are growing at some obscene rate due to an application bug. Truncating the log files using the method above or below can keep the system running.

Also see: http://www.cyberciti.biz/faq/truncate-large-text-file-in-unix-linux/

6
  • 1
    is the colon supposed to indicate a prompt, or does that actually go into the command?
    – Phil
    Mar 26, 2011 at 0:47
  • The colon is part of the command.
    – ewwhite
    Mar 26, 2011 at 0:55
  • You don't actually need the colon.
    – MikeyB
    Mar 26, 2011 at 4:29
  • It's a no-op. It's not needed, but I like to keep it there when I make the recommendation.
    – ewwhite
    Mar 26, 2011 at 12:09
  • This didn't work for me, the log didn't change in size. It went to 0, but then back to its full size
    – dessalines
    Sep 9, 2015 at 13:22
2

You could put it in logrotate, then it won't get out of control as easily

1
  • Ultimately that needs to happen. I'm new at this job...
    – Phil
    Mar 26, 2011 at 0:40
1

If it's actively being written to you don't really have much you can do by way of truncate. Your only options are to blank the file (you could copy it elsewhere first.)

echo "" >/var/log/fileYouWantToEmpty

That way the file ends up empty but is still the same file/inode so it won't disrupt the program that is logging.

0

You can also try cat /dev/null > /var/log/. But, i have to warn the /dev/null is not implemented in some of the older versions...

1
  • truncating the file doesn't work for me, i did the test on centos 7 and on redhat 5
    – c4f4t0r
    Feb 23, 2015 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .