var partition is too small
hi all the var partition on my apache box may be too small. this is a problem because - i originally had newsyslog set at /var/log/httpd-access.log 644 7 100 24B /var/run/httpd.pid 30 which sets httpd-access.log to be rotated in binary format everytime it reaches 100 mb or once every hour for 24 hours. which basically means we only archive less than a day's worth of httpd-access.log's on this machine... the /var partition on this machine is 252 mb. yesterday i was told asked to start archiving httpd-access.logs for analysis over longer periods of time - that i should be keeping a year's worth of logs, if possible. i remember the original reason i set up newsyslog.conf to rotate httpd-access.logs on this machine so frequently is because the webserver is really busy, and this file tends to grow pretty rapidly, and i didn't want to have to log in, stop apache, and archive the logs by hand every day... yesterday i looked into expanding the size of my /var partition by symlinking. -drop to single user mode -stop syslogd -mv /var to /usr/var -umount /var -delete /var directory -create symlink from /usr/var to /var it seems easy, and i did it successfully once, but i hosed a (non)production box yesterday practicing the above procedure. i have a number of questions: -if i copy the contents of /var to /usr/var, then delete the var directory, do i need to modify my fstab? my fstab right now looks like /dev/aacd0s1g /usrufs rw 2 2 /dev/aacd0s1e /varufs rw 2 2 -do i need to modify this so that /var now points to a directory inside /usr? and how? -i'm thinking that this may be too risky a procedure to try on a production box (i guess i'm spooked from ruining the practice box...) - anyone think i should just archive these logs by hand to someplace in my home directory (/usr is very large on this box - 65 gb - and hardly used)? my goal is basically to keep an archive of httpd-access.logs for as long as possible to produce a comprehensive webalizer report... thanks again redmond -- FreeBSD 5.1-RELEASE-p5 FreeBSD 5.1-RELEASE-p5 #0: Wed Sep 24 09:12:23 CDT 2003 8:30AM up 1 day, 17:54, 2 users, load averages: 0.61, 0.58, 0.55 Ken Thompson has an automobile which he helped design. Unlike most automobiles, it has neither speedometer, nor gas gauge, nor any of the numerous idiot lights which plague the modern driver. Rather, if the driver makes any mistake, a giant ? lights up in the center of the dashboard. The experienced driver, he says, will usually know what's wrong. pgp0.pgp Description: PGP signature
Re: var partition is too small
Redmond Militante wrote: hi all the var partition on my apache box may be too small. this is a problem because - i originally had newsyslog set at /var/log/httpd-access.log 644 7 100 24B /var/run/httpd.pid 30 which sets httpd-access.log to be rotated in binary format everytime it reaches 100 mb or once every hour for 24 hours. which basically means we only archive less than a day's worth of httpd-access.log's on this machine... the /var partition on this machine is 252 mb. Looks like sysinstalls defaults. Maybe this should be fixed some fine day :-) yesterday i was told asked to start archiving httpd-access.logs for analysis over longer periods of time - that i should be keeping a year's worth of logs, if possible. i remember the original reason i set up newsyslog.conf to rotate httpd-access.logs on this machine so frequently is because the webserver is really busy, and this file tends to grow pretty rapidly, and i didn't want to have to log in, stop apache, and archive the logs by hand every day... yesterday i looked into expanding the size of my /var partition by symlinking. -drop to single user mode -stop syslogd -mv /var to /usr/var -umount /var -delete /var directory -create symlink from /usr/var to /var That's really bad, because this means that there will be permanent write accesses to you /usr label. A better way could be a cron job which moves the old http-logs once a day into a place in /usr, eg. /usr/save-logs. it seems easy, and i did it successfully once, but i hosed a (non)production box yesterday practicing the above procedure. i have a number of questions: -if i copy the contents of /var to /usr/var, then delete the var directory, do i need to modify my fstab? If you've done it as described, that would be better. But I think you should re-think about the procedure. my fstab right now looks like /dev/aacd0s1g /usrufs rw 2 2 /dev/aacd0s1e /varufs rw 2 2 -do i need to modify this so that /var now points to a directory inside /usr? and how? -i'm thinking that this may be too risky a procedure to try on a production box (i guess i'm spooked from ruining the practice box...) - anyone think i should just archive these logs by hand to someplace in my home directory (/usr is very large on this box - 65 gb - and hardly used)? my goal is basically to keep an archive of httpd-access.logs for as long as possible to produce a comprehensive webalizer report... thanks again redmond Best, Jens ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: var partition is too small
hi a cron job that moves httpd-access.logs to an archive directory sounds like a fine idea - is it safe, though to move these logs while apache and syslogd are running? or would the cron job need to stop those apps first, move the logs, then restart apache/syslogd? thanks redmond [Fri, Oct 03, 2003 at 02:27:00PM +] This one time, at band camp, Jens Rehsack said: Redmond Militante wrote: hi all the var partition on my apache box may be too small. this is a problem because - i originally had newsyslog set at /var/log/httpd-access.log 644 7 100 24B /var/run/httpd.pid 30 which sets httpd-access.log to be rotated in binary format everytime it reaches 100 mb or once every hour for 24 hours. which basically means we only archive less than a day's worth of httpd-access.log's on this machine... the /var partition on this machine is 252 mb. Looks like sysinstalls defaults. Maybe this should be fixed some fine day :-) yesterday i was told asked to start archiving httpd-access.logs for analysis over longer periods of time - that i should be keeping a year's worth of logs, if possible. i remember the original reason i set up newsyslog.conf to rotate httpd-access.logs on this machine so frequently is because the webserver is really busy, and this file tends to grow pretty rapidly, and i didn't want to have to log in, stop apache, and archive the logs by hand every day... yesterday i looked into expanding the size of my /var partition by symlinking. -drop to single user mode -stop syslogd -mv /var to /usr/var -umount /var -delete /var directory -create symlink from /usr/var to /var That's really bad, because this means that there will be permanent write accesses to you /usr label. A better way could be a cron job which moves the old http-logs once a day into a place in /usr, eg. /usr/save-logs. it seems easy, and i did it successfully once, but i hosed a (non)production box yesterday practicing the above procedure. i have a number of questions: -if i copy the contents of /var to /usr/var, then delete the var directory, do i need to modify my fstab? If you've done it as described, that would be better. But I think you should re-think about the procedure. my fstab right now looks like /dev/aacd0s1g /usrufs rw 2 2 /dev/aacd0s1e /varufs rw 2 2 -do i need to modify this so that /var now points to a directory inside /usr? and how? -i'm thinking that this may be too risky a procedure to try on a production box (i guess i'm spooked from ruining the practice box...) - anyone think i should just archive these logs by hand to someplace in my home directory (/usr is very large on this box - 65 gb - and hardly used)? my goal is basically to keep an archive of httpd-access.logs for as long as possible to produce a comprehensive webalizer report... thanks again redmond Best, Jens -- FreeBSD 5.1-RELEASE-p5 FreeBSD 5.1-RELEASE-p5 #0: Wed Sep 24 09:12:23 CDT 2003 9:30AM up 1 day, 18:54, 2 users, load averages: 0.07, 0.17, 0.18 Rules for Academic Deans: (1) HIDE (2) If they find you, LIE -- Father Damian C. Fandal pgp0.pgp Description: PGP signature
Re: var partition is too small
hello i have a practice box set up, i've been trying to resizing /var by symlinking it to /usr/var in theory this is simple - my methodology is drop to single user mode fsck -p mount -u / mount -a -t ufs swapon -a adjkerntz -i mkdir /usr/var cd /var cp -R * /usr/var cd ../ mv /var /var-old ln -s /usr/var comment out the var line in fstab reboot -this works, except the permissions in the var directory are lost. dmesg shows that /var/spool/clientmqueue needs to be owned by smmsp:smmsp and be chmod 770. i get around this by going to one of my backups, unzipping the var directory, and trying the above procedure again, only this time mv'ing the /var contents i extracted from backup into /usr/var this seems to work ok - no errors in dmesg - however, i was using the machine, and i opened up mutt - mutt complained about /var/tmp's permissions not being set right. so - it looks like i may run the risk of losing the correct permissions on some files/directories in var if i decide to try symlinking to give my var partition more space... is there anything i'm missing? i'd really like this to go seamlessly... thanks again redmond [Fri, Oct 03, 2003 at 11:32:30AM -0400] This one time, at band camp, Robert Huff said: Redmond Militante writes: which sets httpd-access.log to be rotated in binary format everytime it reaches 100 mb or once every hour for 24 hours. the /var partition on this machine is 252 mb. In my opinion, if you acknowledge the real possibility of haveing a 100mb file (never mind 100 users' mailboxes) there then /var is _way_ too small. I would have 500mb, and do 1gb if I could afford it. Robert Huff pgp0.pgp Description: PGP signature
Re: var partition is too small
[ sorry about not quoting - braindead mail client ] Moving a filesystem on a live server is *never* a risk-free activity. If you intend to do this, use tar(1) or dump(8) instead of cp(1) - they will deal with special files and other unusual conditions. But if you haven't done this often enough to be confident, I wouldn't start with a production server. Look at the -a option to newsyslog(8) - this allows you to put archived files in a different directory to the live ones. For example, I've modified /etc/crontab so that the newsyslog line reads 0 * * * * rootnewsyslog -a archives This means that all the archived logs will end up in /var/log/archives. If you create this directory as a symlink to a larger filesystem, then /var only has to hold the current logs. (Do this before changing the crontab, otherwise newsyslog will create the directory for you.) ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: var partition is too small
On Fri, Oct 03, 2003 at 09:00:43AM -0500, Redmond Militante wrote: hi all the var partition on my apache box may be too small. this is a problem because - i originally had newsyslog set at /var/log/httpd-access.log 644 7 100 24B /var/run/httpd.pid 30 fwiw I have the following entry in /etc/crontab: 0 * * * * root/home/munk/bin/sh/newsyslog.sh where that script reads: #!/bin/sh YEAR=`date +%Y` ROTATE_DIR=/home/munk/backup/log/$YEAR if [ ! -d $ROTATE_DIR ] then mkdir $ROTATE_DIR fi /usr/sbin/newsyslog -a $ROTATE_DIR /usr/sbin/chown -R root:wheel $ROTATE_DIR \ /bin/chmod -R 750 $ROTATE_DIR so the logfiles get rotated out into /home/munk/backup/log/$YEAR with whatever compression/triggers are setup in /etc/newsyslog.conf. -- Jez Hancock - System Administrator / PHP Developer http://munk.nu/ ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
