From owner-freebsd-questions@FreeBSD.ORG Fri Oct 3 07:44:38 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 92F2E16A4C4 for ; Fri, 3 Oct 2003 07:44:38 -0700 (PDT) Received: from merle.it.northwestern.edu (merle.it.northwestern.edu [129.105.16.57]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6EE7944190 for ; Fri, 3 Oct 2003 07:42:14 -0700 (PDT) (envelope-from r-militante@northwestern.edu) Received: (from mailnull@localhost) by merle.it.northwestern.edu (8.12.10/8.12.10) id h93EflYh029844; Fri, 3 Oct 2003 09:41:47 -0500 (CDT) Received: from merle.it.northwestern.edu (darkpossum.medill.northwestern.edu [129.105.51.23]) by merle.it.northwestern.edu via smap (V2.0) id xma029673; Fri, 3 Oct 03 09:41:40 -0500 Date: Fri, 3 Oct 2003 09:33:23 -0500 From: Redmond Militante To: Jens Rehsack Message-ID: <20031003143323.GC80565@darkpossum> References: <20031003140043.GB80565@darkpossum> <3F7D8734.2060801@liwing.de> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="VywGB/WGlW4DM4P8" Content-Disposition: inline In-Reply-To: <3F7D8734.2060801@liwing.de> User-Agent: Mutt/1.4.1i X-Sender: redmond@darkpossum.medill.northwestern.edu X-URL: http://darkpossum.medill.northwestern.edu/modules.php?name=Content&pa=showpage&pid=1 X-DSA-and-ElGamal-Fingerprint: 2AA2 E78E A6FC 9144 3534 39A2 EE0F 8D26 5FDF 481D cc: freebsd-questions@freebsd.org Subject: Re: var partition is too small X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Redmond Militante List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Oct 2003 14:44:38 -0000 --VywGB/WGlW4DM4P8 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable hi a cron job that moves httpd-access.logs to an archive directory sounds like= a fine idea - is it safe, though to move these logs while apache and syslo= gd are running? or would the cron job need to stop those apps first, move = the logs, then restart apache/syslogd? thanks redmond [Fri, Oct 03, 2003 at 02:27:00PM +0000] This one time, at band camp, Jens Rehsack said: > Redmond Militante wrote: > >hi all > > > >the var partition on my apache box may be too small. > >this is a problem because -=20 > >i originally had newsyslog set at > > > >/var/log/httpd-access.log 644 7 100 24 B=20 > >/var/run/httpd.pid 30 > > > >which sets httpd-access.log to be rotated in binary format everytime it= =20 > >reaches 100 mb or once every hour for 24 hours. > >which basically means we only archive less than a day's worth of=20 > >httpd-access.log's on this machine... > > > > > >the /var partition on this machine is 252 mb. >=20 > Looks like sysinstalls defaults. > Maybe this should be fixed some fine day :-) >=20 > >yesterday i was told asked to start archiving httpd-access.logs for=20 > >analysis over longer periods of time - that i should be keeping a year's= =20 > >worth of logs, if possible. i remember the original reason i set up=20 > >newsyslog.conf to rotate httpd-access.logs on this machine so frequently= =20 > >is because the webserver is really busy, and this file tends to grow=20 > >pretty rapidly, and i didn't want to have to log in, stop apache, and=20 > >archive the logs by hand every day... > > > >yesterday i looked into expanding the size of my /var partition by=20 > >symlinking. > > > >-drop to single user mode > >-stop syslogd > >-mv /var to /usr/var > >-umount /var > >-delete /var directory > >-create symlink from /usr/var to /var >=20 > That's really bad, because this means that there will be permanent > write accesses to you /usr label. >=20 > A better way could be a cron job which moves the old http-logs > once a day into a place in /usr, eg. /usr/save-logs. >=20 > >it seems easy, and i did it successfully once, but i hosed a=20 > >(non)production box yesterday practicing the above procedure. > > > >i have a number of questions: > >-if i copy the contents of /var to /usr/var, then delete the var=20 > >directory, do i need to modify my fstab? >=20 > If you've done it as described, that would be better. > But I think you should re-think about the procedure. >=20 > >my fstab right now looks like > > > >/dev/aacd0s1g /usr ufs rw 2 2 > >/dev/aacd0s1e /var ufs rw 2 2 > > > >-do i need to modify this so that /var now points to a directory inside= =20 > >/usr? and how? > >-i'm thinking that this may be too risky a procedure to try on a=20 > >production box (i guess i'm spooked from ruining the practice box...) -= =20 > >anyone think i should just archive these logs by hand to someplace in my= =20 > >home directory (/usr is very large on this box - 65 gb - and hardly used= )?=20 > >my goal is basically to keep an archive of httpd-access.logs for as long= =20 > >as possible to produce a comprehensive webalizer report... > > > >thanks again > > > >redmond >=20 > Best, > Jens >=20 --=20 FreeBSD 5.1-RELEASE-p5 FreeBSD 5.1-RELEASE-p5 #0: Wed Sep 24 09:12:23 CDT 2= 003 9:30AM up 1 day, 18:54, 2 users, load averages: 0.07, 0.17, 0.18 =20 Rules for Academic Deans: (1) HIDE!!!! (2) If they find you, LIE!!!! -- Father Damian C. Fandal =20 --VywGB/WGlW4DM4P8 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (FreeBSD) iD8DBQE/fYiy7g+NJl/fSB0RAuQ9AJ9/j0HzAzWtLcpYqgx8kEDu+vbaNQCggxqH /pbW4GJRx6SJRyk0JKBrKV0= =IgeB -----END PGP SIGNATURE----- --VywGB/WGlW4DM4P8--