* Stefano Chiesa <[email protected]> [20160517 10:12]: > I have installed the VM version v1.0.2
I know you know, but you should upgrade. > After a year of work I have the root partition full: > > $ df -h > Filesystem Size Used Avail Use% Mounted on > /dev/mapper/graylog--vg-root 15G 15G 0 100% / > none 4.0K 0 4.0K 0% /sys/fs/cgroup > udev 2.0G 4.0K 2.0G 1% /dev > tmpfs 396M 648K 395M 1% /run > none 5.0M 0 5.0M 0% /run/lock > none 2.0G 0 2.0G 0% /run/shm > none 100M 0 100M 0% /run/user > /dev/sda1 236M 37M 187M 17% /boot > > Now I think that I have to delete something here: > > $ sudo find / -path /data1/ -prune -or -size +500M -print > /var/log/graylog/nginx/access.log > /var/log/graylog/web/application.log Feel free to truncate these while graylog is stopped once you've had a look at them: graylog-ctl stop sudo sh -c 'echo "" > /var/log/graylog/nginx/access.log' sudo sh -c 'echo "" > /var/log/graylog/web/application.log' graylog-ctl start > /var/log/graylog/elasticsearch/graylog2.log.2016-05-15 > /var/log/graylog/elasticsearch/graylog2.log.2016-05-13 > /var/log/graylog/elasticsearch/graylog2.log.2016-05-14 This hints that you ran out of space on the 13th :) > /var/opt/graylog/data/mongodb/journal/j._3 > /var/opt/graylog/data/mongodb/journal/prealloc.2 > /var/opt/graylog/data/mongodb/journal/j._4 I wouldn't mess with these. However, consider adding '--smallfiles' to MongoDB's run script at /opt/graylog/service/mongodb/run > I tried to access those directories but the SSH login I use (ubuntu / > ubuntu) is not a root user so I can't access. ubuntu is in sudoers, most stuff is graylog's; try sudo su - graylog > I'm not a linux expert at all so I have some difficulties in solving this > problem. > > Can someone help me on this? start with: sudo ls -lh /var/opt/graylog/data/elasticsearch/graylog2/nodes/0/indices sudo du -csh /var/opt/graylog/data/* Adjust your config to prune more data: http://docs.graylog.org/en/1.0/pages/index_model.html#eviction-of-indices-and-messages Note that your version does not support sized based rotation, so you can't be sure it won't fill up again if someone starts sending bigger messages to it. Consider upgrading ;) qvb -- pica -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/20160517085853.GA19708%40grummit.biaix.org. For more options, visit https://groups.google.com/d/optout.
