limitation of capacity of syslog file

Question

I would like to decrease the storage usage of syslog because the free space of the root partition is small.

Storage usage of syslog are shown below.

-rw-r-----  1 syslog            adm      42G  Aug 31 14:56 syslog
-rw-r-----  1 syslog            adm     3.6G  Aug 31 11:55 syslog.1
-rw-r-----  1 syslog            adm     512M  Aug 30 18:24 syslog.2.gz
-rw-r-----  1 syslog            adm      34K  Aug 28 07:44 syslog.4.gz
-rw-r-----  1 syslog            adm      52K  Aug 27 08:31 syslog.5.gz
-rw-r-----  1 syslog            adm      47K  Aug 26 08:47 syslog.6.gz

To decrease the storage usage (under 1000MB) of syslog, \etc\logrotate.conf was edited as shown below. However, storage use is large now.

# see "man logrotate" for details
# rotate log files weekly
daily

# use the syslog group by default, since this is the owning group
# of /var/log/syslog.
su root syslog

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here
size 1000M

How can I decrease the storage taken by syslog?

score 4 · Accepted Answer · answered Aug 31 '15 at 07:03

I believe you are approaching this from the wrong angle.

Analyzing why it is so large should be your 1st concern: if it is due to errors fix those first. On a highly used system our syslog files are rotated every day and we end up with sizes like this...

    -rw-r----- 1 syslog    adm    2937 Aug 31 08:50 syslog
    -rw-r----- 1 syslog    adm   28451 Aug 31 06:30 syslog.1
    -rw-r----- 1 syslog    adm    2263 Aug 30 06:50 syslog.2.gz
    -rw-r----- 1 syslog    adm    2621 Aug 29 06:30 syslog.3.gz
    -rw-r----- 1 syslog    adm    2392 Aug 28 06:50 syslog.4.gz
    -rw-r----- 1 syslog    adm    2812 Aug 27 06:50 syslog.5.gz
    -rw-r----- 1 syslog    adm    3025 Aug 26 06:50 syslog.6.gz
    -rw-r----- 1 syslog    adm    2372 Aug 25 06:25 syslog.7.gz

So have a look inside syslog with sudo tail /var/log/syslog and see if something jumps out (words like error or lines repeated over and over).

If a 3.6Gb log file is normal for your system (and I highly doubt it) you really need a very very big harddisk.

As a result of checking syslog, errors on EVINCE related to LATEX occurred . By stopping EVINCE, syslog has not increased so much. Thank you! — LenItsuki, Aug 31 '15 at 07:18
If you need help with those errors post another question ;) Those should be fixable too. — Rinzwind, Aug 31 '15 at 08:15

rubo77 · Answer 2 · 2021-02-08T17:42:42.587

First of all, you should try to find the source of the large amount of logging.

If it is not possible to fix the cause, you can try one of these options:

You can set SystemMaxUse=50M in /etc/systemd/journald.conf

see https://askubuntu.com/a/1012913/34298

You can reduce space manually using the journalctl --vacuum command e.g.:

journalctl --vacuum-size=50M

I am not sure if this in fact affects /var/log/syslog too.

Maybe you find out how to do this in /etc/rsyslog.d/50-default.conf, I found this answer:

Limit the size of the current syslog

but it seems outdated. Please tell me if you find the actual solution in a modern Ubuntu.

use this script to manually truncate syslog:

save in /usr/local/sbin/truncate_syslog.sh:

#!/bin/bash
delete all but the last 1000 lines in syslog
LINES=1000
tail -n $LINES /var/log/syslog > /tmp/tmpfile
cat /tmp/tmpfile > /var/log/syslog
rm /tmp/tmpfile
service syslog restart

see my gist

Unfortunately, journalctl has no impact on syslog - however it's a good idea to vacuum journalctl anyway. And I agree with Rinz - instead of just truncating your log, you should really find out why it's 3GB in size, which is really unusual. — Artur Meinild, Feb 08 '21 at 13:25

limitation of capacity of syslog file

2 Answers2

delete all but the last 1000 lines in syslog