0

I am having this situation the log file /var/log/auth.log on my server has grown very large in size.A lot of webserver are running on it and similar stuff I see the log entries since 15 days have not been recorded. I have been doing an SSH on it from my lan and home the server I am referring is having a public IP but I see that log entries are missing on it from past 12 days in /var/log/auth.log.What can be the reason upon this checked size of the directory which stores logs it is 3.7 GB can this be a problem?

Bond
  • 781
  • 4
  • 12
  • 22
  • 1
    What does `df -hT` report? – Steven Monday Jan 31 '11 at 01:10
  • Based on your comment below & a closer reading of your question I'm wondering if your disk isn't full -- see Steven's comment above: If there's no free space obviously nothing can be logged. You'll need to go on a cleaning spree before checking log rotation :) – voretaq7 Jan 31 '11 at 16:22
  • What I did is copied the log files to some remote location and then deleted the files on server so now I am having 3.7 Gb freed on the server about which I reported the problem.I this what log rotate does? – Bond Feb 01 '11 at 05:06

1 Answers1

1

It sounds like your logs are not being rotated. I'd wager that auth.log is >2GB and your filesystem doesn't support files over that size (so no more data can be written to it).

Check your logrotate configuration to ensure that it knows auth.log is supposed to be rotated (with a reasonable timeframe, like every day), and ensure that logrotate is actually running (it's usually part of the daily or hourly cron tasks).

If everything looks good try running logrotate manually (as root) to see if there are any errors.

voretaq7
  • 79,879
  • 17
  • 130
  • 214
  • It is a Ubuntu server I checked the size of auth.log is just 72K but size of folder /var/log is 3.7 Gb here are the file sizes 4.0K ./apparmor 4.0K ./news 56K ./image-store-proxy 4.0K ./unattended-upgrades 32K ./ConsoleKit 44K ./cron-apt 633M ./eucalyptus 360K ./installer/cdebconf 1.3M ./installer 364K ./apache2/site3 4.0K ./apache2/site 1.5G ./apache2/site2 145M ./apache2/log_20_July 630M ./apache2/site1 153M ./apache2/site4 2.4G ./apache2 12K ./fsck ' – Bond Jan 30 '11 at 18:44
  • 4.0K ./landscape 92K ./apt 156K ./libvirt/qemu 160K ./libvirt 4.0K ./dist-upgrade 4.0K ./samba/cores/smbd 4.0K ./samba/cores/nmbd 12K ./samba/cores 1.5M ./samba 3.7G ./ and why is editing so difficult in comments? – Bond Jan 30 '11 at 18:44
  • 1
    Your samba directory looks like a problem... in fact, it looks like your problem exactly. – Kyle Brantley Jan 30 '11 at 22:09