From owner-freebsd-questions@FreeBSD.ORG Fri Oct 3 07:49:42 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5C34716A4DA for ; Fri, 3 Oct 2003 07:49:41 -0700 (PDT) Received: from mail.liwing.de (mail.liwing.de [213.70.188.162]) by mx1.FreeBSD.org (Postfix) with ESMTP id AB29843FE3 for ; Fri, 3 Oct 2003 07:49:39 -0700 (PDT) (envelope-from rehsack@liwing.de) Received: (qmail 83580 invoked from network); 3 Oct 2003 14:49:38 -0000 Received: from stingray.liwing.de (HELO liwing.de) ([213.70.188.164]) (envelope-sender ) by mail.liwing.de (qmail-ldap-1.03) with SMTP for ; 3 Oct 2003 14:49:38 -0000 Message-ID: <3F7D8C81.5030208@liwing.de> Date: Fri, 03 Oct 2003 14:49:37 +0000 From: Jens Rehsack User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.4) Gecko/20030928 X-Accept-Language: de-de, de, en-us, en MIME-Version: 1.0 To: Redmond Militante References: <20031003140043.GB80565@darkpossum> <3F7D8734.2060801@liwing.de> <20031003143323.GC80565@darkpossum> In-Reply-To: <20031003143323.GC80565@darkpossum> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-questions@freebsd.org Subject: Re: var partition is too small X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Oct 2003 14:49:42 -0000 Redmond Militante wrote: > hi Hi Redmond, [message edited because of top-posted] > [Fri, Oct 03, 2003 at 02:27:00PM +0000] > This one time, at band camp, Jens Rehsack said: > > >>Redmond Militante wrote: >> >>>hi all >>> >>>the var partition on my apache box may be too small. >>>this is a problem because - >>>i originally had newsyslog set at >>> >>>/var/log/httpd-access.log 644 7 100 24 B >>>/var/run/httpd.pid 30 >>> >>>which sets httpd-access.log to be rotated in binary format everytime it >>>reaches 100 mb or once every hour for 24 hours. >>>which basically means we only archive less than a day's worth of >>>httpd-access.log's on this machine... >>> >>> >>>the /var partition on this machine is 252 mb. >> >>Looks like sysinstalls defaults. >>Maybe this should be fixed some fine day :-) >> >> >>>yesterday i was told asked to start archiving httpd-access.logs for >>>analysis over longer periods of time - that i should be keeping a year's >>>worth of logs, if possible. i remember the original reason i set up >>>newsyslog.conf to rotate httpd-access.logs on this machine so frequently >>>is because the webserver is really busy, and this file tends to grow >>>pretty rapidly, and i didn't want to have to log in, stop apache, and >>>archive the logs by hand every day... >>> >>>yesterday i looked into expanding the size of my /var partition by >>>symlinking. >>> >>>-drop to single user mode >>>-stop syslogd >>>-mv /var to /usr/var >>>-umount /var >>>-delete /var directory >>>-create symlink from /usr/var to /var >> >>That's really bad, because this means that there will be permanent >>write accesses to you /usr label. >> >>A better way could be a cron job which moves the old http-logs >>once a day into a place in /usr, eg. /usr/save-logs. >> >> >>>it seems easy, and i did it successfully once, but i hosed a >>>(non)production box yesterday practicing the above procedure. >>> >>>i have a number of questions: >>>-if i copy the contents of /var to /usr/var, then delete the var >>>directory, do i need to modify my fstab? >> >>If you've done it as described, that would be better. >>But I think you should re-think about the procedure. >> >> >>>my fstab right now looks like >>> >>>/dev/aacd0s1g /usr ufs rw 2 2 >>>/dev/aacd0s1e /var ufs rw 2 2 >>> >>>-do i need to modify this so that /var now points to a directory inside >>>/usr? and how? >>>-i'm thinking that this may be too risky a procedure to try on a >>>production box (i guess i'm spooked from ruining the practice box...) - >>>anyone think i should just archive these logs by hand to someplace in my >>>home directory (/usr is very large on this box - 65 gb - and hardly used)? >>>my goal is basically to keep an archive of httpd-access.logs for as long >>>as possible to produce a comprehensive webalizer report... >>> >>>thanks again >>> >>>redmond >> >>Best, >>Jens > > a cron job that moves httpd-access.logs to an archive directory sounds > like a fine idea - is it safe, though to move these logs while apache > and syslogd are running? or would the cron job need to stop those > apps first, move the logs, then restart apache/syslogd? Nope, you should move the newsyslog-compressed ones. You can either renumber them using ports/sysutils/mmv or add a time-stamp to the filenames. > thanks Best regards, Jens