I am running out of space and would like to move my logs to recover some room on my SSD. My question:

  1. I have an SSD (mounted at /) and regular hard-drive (mounted at /mnt/d2). How can I change it so that my logs (all the logs stored in /var/log) are stored somewhere on my other hard-drive (maybe /mnt/d2/var/log)?

Thank you!

sudo /etc/init.d/rsyslog stop
sudo mv /var/log /mnt/d2/
sudo ln -s /mnt/d2/log /var/log
sudo /etc/init.d/rsyslog start

You might want to go ahead and reboot the machine, while you're at it, just in case you have something other than rsyslogd busily trying to write to logs under /var/log - those won't recover until they're restarted as well, which just bouncing the whole box will accomplish nicely.

What we're doing here is, instead of trying to reconfigure everything that might possibly want to write to /var/log, instead just gently redirecting things going there to your other disk. You can still cd /var/log or less /var/log/syslog or whatever and have it work just fine, this way, and any new programs that try to log to directories under /var/log directly rather than working through rsyslogd will also still work as expected.

  • Ah, this is so helpful. Thank you. I thought to potentially do the symlinking, but I got caught up in a mire of symlink subtleties (didn't think to stop rsyslog).
    – aaronlevin
    Nov 23 '12 at 22:57

I don't have enough reputation to add this as a comment, so here it is as a necro-answer:

It's probably better to mount-bind this in your fstab, copy all the logfiles currently in it to the new partition, then reboot. Then clear the old /var/log. Don't diddle around with symlinks and trying to whack-a-mole running services. You're gonna have a bad time, eventually.

  • 2
    Showing the code of "mount-bind this in your fstab" would probably help people. Showing the commands to copy the files will also help them. Mar 13 '18 at 0:33
  • As you mentioned this is a comment not a solution to the question. Please add some commands that the user can try
    – Teocci
    Mar 13 '18 at 3:56
  • This is probably really is better than a symlink but care needs to be taken with bind-mounts in fstab with systemd or they will be attempted before the physical drive is mounted. See this. Will also provide an example. unix.stackexchange.com/questions/216287/…
    – DKebler
    Nov 24 '18 at 23:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.