var partition is too small

[Jens Rehsack]

Redmond Militante wrote:
> hi

Hi Redmond,

[message edited because of top-posted]

> [Fri, Oct 03, 2003 at 02:27:00PM +0000]
> This one time, at band camp, Jens Rehsack said:
> 
> 
>>Redmond Militante wrote:
>>
>>>hi all
>>>
>>>the var partition on my apache box may be too small.
>>>this is a problem because - 
>>>i originally had newsyslog set at
>>>
>>>/var/log/httpd-access.log               644  7     100  24    B 
>>>/var/run/httpd.pid 30
>>>
>>>which sets httpd-access.log to be rotated in binary format everytime it 
>>>reaches 100 mb or once every hour for 24 hours.
>>>which basically means we only archive less than a day's worth of 
>>>httpd-access.log's on this machine...
>>>
>>>
>>>the /var partition on this machine is 252 mb.
>>
>>Looks like sysinstalls defaults.
>>Maybe this should be fixed some fine day :-)
>>
>>
>>>yesterday i was told asked to start archiving httpd-access.logs for 
>>>analysis over longer periods of time - that i should be keeping a year's 
>>>worth of logs, if possible.  i remember the original reason i set up 
>>>newsyslog.conf to rotate httpd-access.logs on this machine so frequently 
>>>is because the webserver is really busy, and this file tends to grow 
>>>pretty rapidly, and i didn't want to have to log in, stop apache, and 
>>>archive the logs by hand every day...
>>>
>>>yesterday i looked into expanding the size of my /var partition by 
>>>symlinking.
>>>
>>>-drop to single user mode
>>>-stop syslogd
>>>-mv /var to /usr/var
>>>-umount /var
>>>-delete /var directory
>>>-create symlink from /usr/var to /var
>>
>>That's really bad, because this means that there will be permanent
>>write accesses to you /usr label.
>>
>>A better way could be a cron job which moves the old http-logs
>>once a day into a place in /usr, eg. /usr/save-logs.
>>
>>
>>>it seems easy, and i did it successfully once, but i hosed a 
>>>(non)production box yesterday practicing the above procedure.
>>>
>>>i have a number of questions:
>>>-if i copy the contents of /var to /usr/var, then delete the var 
>>>directory, do i need to modify my fstab?
>>
>>If you've done it as described, that would be better.
>>But I think you should re-think about the procedure.
>>
>>
>>>my fstab right now looks like
>>>
>>>/dev/aacd0s1g           /usr            ufs     rw              2       2
>>>/dev/aacd0s1e           /var            ufs     rw              2       2
>>>
>>>-do i need to modify this so that /var now points to a directory inside 
>>>/usr? and how?
>>>-i'm thinking that this may be too risky a procedure to try on a 
>>>production box (i guess i'm spooked from ruining the practice box...) - 
>>>anyone think i should just archive these logs by hand to someplace in my 
>>>home directory (/usr is very large on this box - 65 gb - and hardly used)? 
>>>my goal is basically to keep an archive of httpd-access.logs for as long 
>>>as possible to produce a comprehensive webalizer report...
>>>
>>>thanks again
>>>
>>>redmond
>>
>>Best,
>>Jens
 >
 > a cron job that moves httpd-access.logs to an archive directory sounds
 > like a fine idea - is it safe, though to move these logs while apache
 > and syslogd are running?  or would the cron job need to stop those
 > apps first, move the logs, then restart apache/syslogd?

Nope, you should move the newsyslog-compressed ones. You can either
renumber them using ports/sysutils/mmv or add a time-stamp to the
filenames.

 > thanks

Best regards,
Jens