My serverv hard disk the '/' partition is at 100% capacity and as all of other partitions are minimal in nature, I will need to remove any large logs/files or archive them to clear room in '/'. I list the contents of /var(It appears that the largest directory mounted on '/' is '/var')

[root@ensim var]# ls
account      appliance  db     gdm    lock  mailman  opt       spool    tux    yp
adm      cache  empty  lib    log   named    preserve  tmp  usage  zope
analog-5.32  crash  ftp    local  mail  nis      run       tomcat4  www

I also list the content of log

[root@ensim var]# cd log
[root@ensim log]# ls
appliance   cron.3   ksyms.4    messages      rpmpkgs.3     spooler.2  wpchkquota.log
boot.log    cron.4   ksyms.5    messages.1    rpmpkgs.4     spooler.3  wtmp
boot.log.1  cups     ksyms.6    messages.2    samba     spooler.4  wtmp.1
boot.log.2  dmesg    lastlog    messages.3    scrollkeeper.log  squid      xferlog
boot.log.3  ensim    mail   messages.4    secure        tmp    xferlog.1
boot.log.4  gdm      maillog    mysqld.log    secure.1      up2date    xferlog.2
clamav      httpd    maillog.1  mysqld.log.4  secure.2      up2date.1  xferlog.3
conf        ksyms.0  maillog.2  pgsql         secure.3      up2date.2  xferlog.4
cron        ksyms.1  maillog.3  rpmpkgs       secure.4      up2date.3  xferlog.5
cron.1      ksyms.2  maillog.4  rpmpkgs.1     spooler       up2date.4  yum.ensim.log
cron.2      ksyms.3  mailman    rpmpkgs.2     spooler.1     vbox       zope


[root@ensim log]# du -sh ./*
4.0M    ./appliance
8.0K    ./boot.log
4.0K    ./boot.log.1
4.0K    ./boot.log.2
4.0K    ./boot.log.3
0   ./boot.log.4
472K    ./clamav
60K ./conf
28K ./cron
372K    ./cron.1
252K    ./cron.2
316K    ./cron.3
0   ./cron.4
24K ./cups
12K ./dmesg
84K ./ensim
4.0K    ./gdm
876K    ./httpd
84K ./ksyms.0
84K ./ksyms.1
84K ./ksyms.2
84K ./ksyms.3
84K ./ksyms.4
84K ./ksyms.5
84K ./ksyms.6
60K ./lastlog
4.0K    ./mail
19M ./maillog
7.1G    ./maillog.1
179M    ./maillog.2
210M    ./maillog.3
0   ./maillog.4
4.0K    ./mailman
508K    ./messages
4.3M    ./messages.1
1.6M    ./messages.2
19M ./messages.3
0   ./messages.4
4.0K    ./mysqld.log
0   ./mysqld.log.4
0   ./pgsql
32K ./rpmpkgs
32K ./rpmpkgs.1
32K ./rpmpkgs.2
32K ./rpmpkgs.3
32K ./rpmpkgs.4
4.0K    ./samba
4.0K    ./scrollkeeper.log
104K    ./secure
1.5M    ./secure.1
1.2M    ./secure.2
2.3M    ./secure.3
0   ./secure.4
0   ./spooler
0   ./spooler.1
0   ./spooler.2
0   ./spooler.3
0   ./spooler.4
4.0K    ./squid
24G ./tmp
0   ./up2date
0   ./up2date.1
0   ./up2date.2
0   ./up2date.3
0   ./up2date.4
4.0K    ./vbox
4.0K    ./wpchkquota.log
68K ./wtmp
96K ./wtmp.1
0   ./xferlog
4.0K    ./xferlog.1
4.0K    ./xferlog.2
128K    ./xferlog.3
4.0K    ./xferlog.4
4.0K    ./xferlog.5
0   ./yum.ensim.log
0   ./zope


[root@ensim log]# du -sh *  
4.0M    appliance
8.0K    boot.log
4.0K    boot.log.1
4.0K    boot.log.2
4.0K    boot.log.3
0   boot.log.4
472K    clamav
60K conf
28K cron
372K    cron.1
252K    cron.2
316K    cron.3
0   cron.4
24K cups
12K dmesg
84K ensim
4.0K    gdm
876K    httpd
84K ksyms.0
84K ksyms.1
84K ksyms.2
84K ksyms.3
84K ksyms.4
84K ksyms.5
84K ksyms.6
60K lastlog
4.0K    mail
19M maillog
7.1G    maillog.1
179M    maillog.2
210M    maillog.3
0   maillog.4
4.0K    mailman
508K    messages
4.3M    messages.1
1.6M    messages.2
19M messages.3
0   messages.4
4.0K    mysqld.log
0   mysqld.log.4
0   pgsql
32K rpmpkgs
32K rpmpkgs.1
32K rpmpkgs.2
32K rpmpkgs.3
32K rpmpkgs.4
4.0K    samba
4.0K    scrollkeeper.log
108K    secure
1.5M    secure.1
1.2M    secure.2
2.3M    secure.3
0   secure.4
0   spooler
0   spooler.1
0   spooler.2
0   spooler.3
0   spooler.4
4.0K    squid
24G tmp
0   up2date
0   up2date.1
0   up2date.2
0   up2date.3
0   up2date.4
4.0K    vbox
4.0K    wpchkquota.log
68K wtmp
96K wtmp.1
0   xferlog
4.0K    xferlog.1
4.0K    xferlog.2
128K    xferlog.3
4.0K    xferlog.4
4.0K    xferlog.5
0   yum.ensim.log
0   zope

what content are not useful and can be removed?


what content are not useful and can be removed?

Well, only you can decide that. How can we know what your server is being used for?

What is the largest directory within /var? If I were to guess, it would be /var/log, which is where your system logs go. Find the largest files in there and either delete them or copy to another server for archiving. Then, to prevent this in the future, make sure that logrotate is installed and configured correctly.

  • (and du -sh ./* is your friend.) – Shane Madden Jul 24 '13 at 4:15
  • I updated thw question, capacity of ./tmp is 24G – user62414 Jul 24 '13 at 4:19
  • 1
    It looks like you have logrotate configured, but not set to compress. You should consider enabling that. – EEAA Jul 24 '13 at 4:23
  • This is a site I host my freeware(windows). Sorry I am not familiar with linux. I use softlayer dedicated server, they have setup all thing – user62414 Jul 24 '13 at 4:28
  • 4
    Well, then I suggest you read up on linux systems administration. – EEAA Jul 24 '13 at 4:32

Your /var/maillog is a fat pig. She’s weighing’ in at 7 Gs. You will want to introduce her to Jenny Craig, for sure. But before you bust out with the ol' rm -f /var/maillog, you probably want to summarize the entries, to spot any indications of problems with your mail config / setup / usage. Many a more refined and dignified way to do this, so don’t laugh at the caveman manner I show here:

cat /var/log/maillog | cut -d":" -f4 | sort | uniq -c

just verify that the 4th field is the ‘meat and potatoes (shouts out to Dan Quayle, just kidding…)’.

Find the biggest offenders, and deduce if there is another problem indicated. i.e. I once had a piece of outgoing mail that kept getting bounced infinitely and it accounted for too many an entry in the ol’ mail.log… I eventually tracked down the problem: a mistyped domain name that had no MX record to speak to. Yet the mail got dequeued for attempted delivery…

Fixed gmale.com or somesuch to gmail.com, and kicked that thing on out of the queue. The repeated log entries also highlighted a misconfiguration of the MTA.

Here’s a useful find, recursive, to identify the individual, non-collaborator, epic overeaters and mamamoosers hidden in the directory structure of a filesystem:

find /var -size +10000000
  • I backuped amd removed the directory maillist1.log – user62414 Jul 24 '13 at 7:11

This doesnt help with figuring out what to delete, but will get you some extra space if your file system is extX (ext2,3 or 4) You can probably reclaim some space from the reserved blocks:

in tune2fs man page:

-m reserved-blocks-percentage Set the percentage of the filesystem which may only be allocated by privileged processes. Reserving some number of filesystem blocks for use by privileged processes is done to avoid filesystem fragmenâ tation, and to allow system daemons, such as syslogd(8), to continue to function correctly after non-privileged processes are prevented from writing to the filesystem. Normally, the default percentage of reserved blocks is 5%.

As such, you can run the following

tune2fs -m 1 /dev/sda1

Where /dev/sda is the device name of your root partition.


I would recommend this (as a scheduled run in cron)

find /var/log/ -type f -mtime +7 -name '*.bz2' -exec rm "{}" \;
find /var/log/ -type f -mtime +1 -not -name '*.bz2' -exec bzip2 "{}" \;

Which will let you keep your logs, but without them hogging that much space, as log files do compress really well.

It feel free to adjust the number of days you want to keep them uncompressed and compressed by changing the -mtime argument to find.

  • 1
    Log management on RHEL is better done by logrotate, but apart from that, I agree with you that it's worth doing. – MadHatter Jul 24 '13 at 6:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.