var partition is too small

[Rob]

[ sorry about not quoting - braindead mail client ]

Moving a filesystem on a live server is *never* a risk-free activity. If
you intend to do this, use tar(1) or dump(8) instead of cp(1) - they
will deal with special files and other unusual conditions.

But if you haven't done this often enough to be confident, I wouldn't
start with  a production server.

Look at the -a option to newsyslog(8) - this allows you to put archived
files in a different directory to the live ones.

For example, I've modified /etc/crontab so that the newsyslog line reads

0     *       *       *       *       root    newsyslog -a archives

This means that all the archived logs will end up in /var/log/archives.
If you create this directory as a symlink to a larger filesystem, then
/var only has to hold the current logs.

(Do this before changing the crontab, otherwise newsyslog will create
the directory for you.)