Ever Growing Log Files

[Jim Frost]

In article <506 at thor.wright.EDU> tmcclory at odin.wright.edu (Tom McClory) writes:
|As a fledgling system administrator, I'm discovering a number
|of files that keep growing over time.  Some examples are:
|	/usr/adm/wtmp
|	/usr/adm/sulog
|	various uucp log files
|	etc.
|
|My question is, what are the "standard" system files that
|forever grow like this unless I do something explicit.

Which files exist depend on your particular version of UNIX and which
daemons you are running.  You got most of the common ones,
/usr/adm/messages is another one (and generally the biggest excepting
heavily used programs such as UUCP).

What I do to help manage this is to add something like:

0 1 * * * tail -500 /usr/adm/messages > /usr/adm/messages.tmp \
          mv /usr/adm/messages.tmp /usr/adm/messages ; \
          date +"%h %d %H:%M %y: file truncated to 500 lines" >> \
          /usr/adm/messages

to crontab, which causes the messages file to be truncated to 500
lines (and the truncation logged) every night at 1am.  Note that the
lines should be joined at the backslashes (I don't believe cron would
like the above verbatim).  If you want to do this to a lot of files
you should make a more general-purpose shell script.

This technique has drawbacks; you'll loose older information and in
the worst case (some error happening repeatedly enough to push an
important message beyond the truncation, such as network errors) you
can loose something important.  Generally you know when you're having
a bad time, though, so this technique really helps management.

I really recommend adding this kind of automatic management to
machines which are seldom administered (eg workstations).

jim frost
madd at bu-it.bu.edu