54 GB in /var/log!! -- UPDATE

[Craig White]

On Mon, 2008-10-27 at 15:50 +0000, Beartooth wrote:
> On Sun, 26 Oct 2008 20:12:21 +0000, Beartooth wrote:
> 
> > One of my F9 machines -- actually my #1 main machine -- started having
> > display problems. 
> 	[....]
> > 	Obviously, I want to cut /var/log with electronic double-bitted
> > axes in both hands, to get to my user's GUI again; and to find the
> > source of the bloat and correct it.
> 
> 	Having eventually -- thanks to the invaluable help here -- 
> discovered that the culprit was /var/log/messages-20081026, with the 
> whole 54GB; having failed to understand the problem, and finally deleted 
> it just to get back, I'm now on the #1 machine again, and I see : 
> 
> =====		=====		=====		=====
> [root at Hbsk2 btth]# df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/mapper/VolGroup00-LogVol00
>                        72G   18G   51G  26% /
> /dev/sda1             190M   25M  156M  14% /boot
> tmpfs                 1.5G   48K  1.5G   1% /dev/shm
> /dev/sdb1              75G   15G   61G  20% /media/System
> [root at Hbsk2 btth]# 
> 	=====		=====		=====		=====
> 
> 	All I could tell, from my sadly ineffectual attempts to skim the 
> bad file without GUI means, was that it kept saying something about some 
> USB device, and also that some device couldn't do fax. (I never use fax.)
> 
> 	I'm very sorry not to have a better explanation of what happened, 
> especially inasmuch as I'm also worried. Unless it was some inadvertent 
> command, blamable on my arthritic eyeballs and trifocal fingers, and thus 
> a fluke, it might happen again.
> 
> 	I think logrotate must be working, because both the file for the 
> 25th and the 27th were reported nonexistent. In fact, I'm not at all sure 
> it was me that deleted the bad one; maybe logrotate did it.
> 
> 	I took a look : 
> 
> =====		=====		=====		=====
> [root at Hbsk2 btth]# file /var/log/messages-20081027
> /var/log/messages-20081027: ERROR: cannot open `/var/log/
> messages-20081027' (No such file or directory)
> [root at Hbsk2 btth]# file /var/log/messages-20081026
> /var/log/messages-20081026: empty
> [root at Hbsk2 btth]# file /var/log/messages-20081025
> /var/log/messages-20081025: ERROR: cannot open `/var/log/
> messages-20081025' (No such file or directory)
> [root at Hbsk2 btth]# 
> 	=====		=====		=====		=====
> 
> 	Does that tell anyone anything more than it does me? Does it look 
> like, or at least compatible with, logrotate?
> 
> 	I suppose I should take a look at root's mail. What should I look 
> there for? (I think I do have logwatch running on this machine.)
----
probably because you're out of space to create them

Just do this at command line (as root)

# > /var/log/messages

that will completely empty it out (the # sign signifies root and
prevents e-mail from thinking it is part of a reply. Don't type the #
sign)

Craig