How can I safely purge the archival contents of /var/log and how do I change log retention policies?

Question

The contents of /var/log on my system are now taking up 80% of my hard drive and it's causing a lot of problems.

So I need to purge all the old contents but for some reason sudo rm -rf "*.gz" does not remove those old files. Also weirdly enough I'm not 100% sure that all the logfiles I can see actually amount to the huge disk usage I'm dealing with. Why would the Disk Usage Analysis tool show over 600GB used in /var/log when I can't find that much usage with ls?

Also, going forward I'd like to make sure this doesn't happen any more so I want to change the log file retention or rotation policies (however they're named).

EDIT: The du command shows me that the syslog.1 takes up 597GB. How do I change the way that whatever makes that log works to avoid this?

Edit2: I think this link shows the root cause but I don't know what to do about it. https://www.mail-archive.com/kernel-packages@lists.launchpad.net/msg386959.html

Answer 1

Start by examining the log and find what is filling it up. Then fix that issue.

ALL log files in /var/log/ that end in .gz are old compressed log files and can be deleted with

sudo rm -rf *.gz

That will leave the current logs intact. Those SHOULD end in .log. If a log ending on a digit gets lines added (where it should add them to *.log you will need to examine the software that adds to this log. There will be a mistake in one of the configuration files.

Make sure the permissions to *.log are correct. That could also be an issue.

• syslog should be -rw-r----- 1 root adm
• mysql.log should be -rw-r----- 1 mysql adm
• apache2 is a directory and should be drwxr-x--- 2 root adm The 2 files in there should be -rw-r----- 1 root adm

If you need to empty ACTIVE log files do not use rm but use > /var/log/{logfile}. That will keep the permissions of the file, empty it and keep the file on disk present.