Remember this - that very little is needed to make a happy life.

- Marcus Aurelius


Recently, I needed to clear out some disk space on a GNU/Linux server. I had been having trouble getting disk usage below 93%, which is awfully high. I decided to find and rotate my largest log files.

My GNU/Linux tool of choice for rotating log files in is the utility, logrotate. The logrotate utility has a well-defined configuration syntax, which makes it easy to use in order to keep your log files in check. However, I needed to find out which log files I needed to rotate, before I could provide them as arguments to logrotate.

I used the following bash shell command to find log files, and sort them by size. This command is most effective if it is run by a superuser such as root.

find / -name "*.log" -print  2>/dev/null | xargs ls -l | tr -s ' ' | cut -d' ' -f5,9 | sort -g -k1 -r | head -50

Notes:

find is a popular GNU/Linux utility for finding files on the filesystem

xargs takes in standard input and puts out executable shell commands

tr translates characters, in this case "squeezing" all contiguous blank spaces into one

cut picks off the fifth and ninth token from the output of the ls command invoked by xargs

sort re-orders the output in general mathematical order, on the first key in the line, all in reverse order

head limits the returned results to just the first fifty files on the list (which are the top fifty largest files)

After having found log files to rotate, I just needed to create entries for them in:

/etc/logrotate.conf

or more likely in an appropriately-named file under:

/etc/logrotate.d

For example, I had several large Oracle Portal log files that needed to be rotated on a regular basis. I created a file called /etc/logrotate.d/oracle-portal, that contained the following logrotate configuration commands (list of files truncated for brevity):

/apps/oracle/portal_infra_home/ldap/install/checkdsattr.log /apps/oracle/portal_infra_home/sysman/log/em-web-access.log {

        notifempty

        daily

        rotate 3

        missingok

        compress

}


In order to verify that everything was working in my logrotate script, I ran it manually, with the "force" option:

/usr/sbin/logrotate -f /etc/logrotate.conf

I then checked to make sure that my intended files were successfully rotated. As I expected, there was a new gzipped file, checkdsattr.log.1.gz, under:

/apps/oracle/portal_infra_home/ldap/install/


The logrotate utility is generally invoked daily by a process scheduling utility called cron. Once the logrotate entry was in place, I had to add a cron job for the invocation of logrotate. I first checked to see if there was an entry already in place for logrotate, by using this command:

crontab -l


There was no entry in place, so I added a crontab entry for logrotate:

crontab -e # vi editor will launch

59 23 * * 1-5 /usr/sbin/logrotate /etc/logrotate.conf

# save the file and exit - in vi that's <ESC>:wq


I then had a cron entry that would launch logrotate, and run all of the logrotate scripts in /etc/logrotate.d, every weekday at one minute before midnight.


These steps helped me to free some disk space on the server. Did you do things differently? I would be interested to hear how you solved this problem.