log growing too big, syslogd freezes

[jvivenot]

Hi
I had a little problem a few days ago : The boot freezed on "Starting system log" and never continued.
With recovery mode, I saw that my /var/log/syslog was 2.0GB big and it seemed to be the problem. Shouldn't this be a way to rotate the log when it grows too big ?

I'm sorry for my poor english but i'm still open to any further explanation you'd want to ask.

Thanks

Julien Vivenot

Note: the original reporter indicated the bug was in package 'syslogd'; however, that package was not published in Ubuntu.

[H3g3m0n (h3g3m0n)]

I too had a similar problem.

I printed a few pdfs today and a few hours later I ran out of diskspace. I looked through the hard drive with the analyzer and found a 35.6gb file in /var/log/cupsd/error_log

Bug #64548 also had a fairly large log.

I believe the logs do rotate but on a time basis but not size.

Having logs rotate with size could be a security issue though, if you have done something you don't want logged, you could cause the logs to be flooded with something else until its removed from the logs, but it would be less of a security issue than harddrives being flooded. The logs directory shouldn't be bigger than a few 100 mb (mines 7mb without the 35gb log).

The alternative is to look at partitioning off the log directory, but its a bit of a pain for a desktop system. Maybe if ZFS gets ported to Linux properly it would be easy to add a partition and quota to the log directory.

[Mathias Gug (mathiaz)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. The syslog daemon is not responsible for rotating log files. You should try to increase the frequency of you log rotation.

[Nigel Stewart (nigels)]

I've had two Ubuntu system suffer this problem to the extent that the / filesystem runs out of space, and in one case resulting in corruption of a MySQL database. In future I plan to put /var/log in a seperate partition, but an alternative solution would indeed be desirable.

I don't agree that simply increasing the frequency of log rotations is an adequate solution.