why the /var/log/ folder is full

Question

I recently found my linux test server /var/log/ is full, it has used 3.8g. But when I list the files in it, it only shows around 800M.

df -hl

Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_os-lv_root
                      2.0G  1.3G  519M  72% /
tmpfs                 3.9G     0  3.9G   0% /dev/shm
/dev/sda1             239M  105M  122M  47% /boot
/dev/mapper/vg_os-lv_tmp
                      976M   36M  889M   4% /tmp
/dev/mapper/vg_os-lv_usr
                      9.8G  1.9G  7.4G  20% /usr
/dev/mapper/vg_os-lv_var
                      5.8G  2.3G  3.3G  41% /var
/dev/mapper/vg_os-lv_var_log
                      3.9G  3.8G     0 100% /var/log
/dev/mapper/vg_data-lv_data
                       79G  9.7G   66G  13% /data

ll /var/log

total 799984
-rw-------. 1 root root      4459 Apr 23  2014 anaconda.ifcfg.log
-rw-------. 1 root root     31482 Apr 23  2014 anaconda.log
-rw-------. 1 root root     42372 Apr 23  2014 anaconda.program.log

......

-rw-------  1 root root       352 Jul 26  2016 yum.log-20170101
-rw-------  1 root root       180 May 25  2017 yum.log-20180101

I've also tried du -h, seems also around 800M

4.0K    /var/log/newrelic-infra
du: cannot read directory `/var/log/audit': Permission denied
112K    /var/log/audit
7.3M    /var/log/rhsm
du: cannot read directory `/var/log/aws': Permission denied
4.0K    /var/log/aws
12K     /var/log/ConsoleKit
6.7M    /var/log/sa
du: cannot read directory `/var/log/sssd': Permission denied
4.0K    /var/log/sssd
20K     /var/log/vmware-imc
du: cannot read directory `/var/log/httpd': Permission denied
4.0K    /var/log/httpd
du: cannot read directory `/var/log/samba': Permission denied
4.0K    /var/log/samba
4.0K    /var/log/ntpstats
60K     /var/log/tuned
du: cannot read directory `/var/log/lost+found': Permission denied
16K     /var/log/lost+found
8.0K    /var/log/prelink
796M    /var/log

Why is that? How to solve this problem ?

Thanks,

Frank

Answer 1

Hello

Use du -h /var/log or ls -hal -R /var/log to show all. On Linux, i.e. Raspberry Pi, i using a simple softlink for unwanted spam logs. The target is like a black hole and eats everything...

ln -sf /dev/null /var/log/anaconda.log

And of course you have to do this as super Q user root