I took over a Fedora server where the /var/log folder keeps growing to over 100gb of data and some of the logs are old. I think some of them are logs being sent from our Firewall but how do I determine where all the messages are coming from?
Generally speaking, 100gb of logs in
/var/log indicates that
logrotate was either not implemented or misconfigured or broken for some reason. Logs in
/var/log are subject to policies defined in configuration of
logrotate. I would first look whether it is installed (it should be by default on many distros) and how exactly configured in configuration file - most commonly
Second problem is generation of so many log data. If firewall / iptables-netfilter is suspected search for
--log-prefix in output of
iptables -L -n. Take action accordingly.
Your problem may be long time present but never escalated, speaking from my personal experience.