I took over a Fedora server where the /var/log folder keeps growing to over 100gb of data and some of the logs are old. I think some of them are logs being sent from our Firewall but how do I determine where all the messages are coming from?
1 Answer
Generally speaking, 100gb of logs in /var/log
indicates that logrotate
was either not implemented or misconfigured or broken for some reason. Logs in /var/log
are subject to policies defined in configuration of logrotate
. I would first look whether it is installed (it should be by default on many distros) and how exactly configured in configuration file - most commonly /etc/logrotate.conf
.
Second problem is generation of so many log data. If firewall / iptables-netfilter is suspected search for --log-prefix
in output of iptables -L -n
. Take action accordingly.
Your problem may be long time present but never escalated, speaking from my personal experience.