0

Tracking ubuntu 14.04.3 firewall info I enabled ufw full login for a while (now turned back off). Now I'm warned I run out of space in the /var partition. Looking there in I find 3 huge files: kern.log, syslog and ufw.log, each 1.2GB. How do I force some existing routine (if there is one) to anticipate the scheduled job of cleaning/compressing/or-whatever the logs?

Thank you

Improve this question

2 Answers 2

Reset to default
2

Take a look @ logrotate package, you can see a tutorial on this page

you could either

  • Lower the level of logging of your firewall: modify the LOGLEVEL directive into the /etc/ufw/ufw.conf file to one of 'off', 'low', 'medium', 'high' and sudo service ufw restart
  • reconfigure your firewall so that it logs in another part where you have more space
  • configure logrotate to rotate the logs more frequently instead of being into /etc/cron.daily/logrotate for example into /etc/cron.hourly/logrotate (see this post)
    1. sudo ln -s /etc/cron.daily/logrotate /etc/cron.hourly/logrotate
    2. Modify the /etc/logrotate.d/ufw file according to this post to manage the size of rotation and man logrotate for more configuration options. It could be that your file is not rotated because of file size which is not setted, by default the size directive is not setted into the /etc/logrotate.d/ufw file so it is only rotated weekly according to the configuration file directive. So changing it putting a size directive (for example size 300M) will do what you expect maybe. Please note: If the size directive is used, logrotate will ignore the daily, weekly, monthly, and yearly directives. If you want logrotate to consider both log size AND timestamp, the minsize directive should be used.
    3. Run manually if you want the logrotate job to test it with sudo /etc/cron.daily/logrotate
    4. Check the logrotate jobs into the /var/lib/logrotate/status file (see this post)
  • If you don't want ufw to log into your kern.log check this post
Improve this answer
12
  • Although it ran this morning: cat /var/lib/logrotate/status |grep ufw "/var/log/ufw.log" 2016-1-4-7:44:7 sudo logrotate -v /etc/logrotate.d/ufw reading config file /etc/logrotate.d/ufw Handling 1 logs rotating pattern: /var/log/ufw.log weekly (4 rotations) empty log files are not rotated, old logs are removed considering log /var/log/ufw.log error: skipping "/var/log/ufw.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
    – useful
    Jan 4, 2016 at 13:09
  • and? did it do the trick? checkout this post: stackoverflow.com/questions/26482773/… and first answer example post your /etc/logrotate.d/ufw file in your question please
    – Philippe Gachoud
    Jan 4, 2016 at 13:15
  • It failed manu now (although sudo) but this morning it worked auto ??? cat /var/lib/logrotate/status |grep ufw "/var/log/ufw.log" 2016-1-4-7:44:7 cat /etc/logrotate.d/ufw /var/log/ufw.log { rotate 4 weekly missingok notifempty compress delaycompress sharedscripts postrotate invoke-rc.d rsyslog reload >/dev/null 2>&1 || true endscript } how could it work this morning with no create directive? Or is it cron working as noboby or god?
    – useful
    Jan 4, 2016 at 13:22
  • Did you try logrotate command as it is set into the cron job? try to run the /etc/cron.daily/logrotate shell script with sudo /etc/cron.daily/logrotate the environment which is calling a cron job may be different from the one you are in with your console...
    – Philippe Gachoud
    Jan 4, 2016 at 13:46
  • This link linuxslut.net/… in the stackoverflow thread seems very interesting but I can't understand anything, e.g. my /etc/logrotate.d/ufw has no create directive, so how could I add a su user group directive that match this non existent one... sudo /etc/cron.daily/logrotate enter echo $? enter returns 0 .... but all 3 files are still there as huge as before. Believing it could be long I checked with ps ax|grep logrot and ps ax|grep roller and process monitor but found nothing that helps.
    – useful
    Jan 4, 2016 at 15:08
0

I just deleted the log and posted a bug : https://bugs.launchpad.net/ubuntu/+source/logrotate/+bug/1530904 For kern.log and syslog I hope the night will help.

Improve this answer
3
  • -deleting- a currently active log can cause crashes. The correct way is to -empty- the log with > /var/log/{logfile}. Logs ending on digits or tar.gz feel free to delete.
    – Rinzwind
    Jan 4, 2016 at 21:14
  • Rinzwind will say sudo echo "" > /var/log/ufw.log for you for emptying the log file...
    – Philippe Gachoud
    Jan 5, 2016 at 7:50
  • Silly me, I should have had this idea.
    – useful
    Feb 11, 2016 at 10:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .