command to clean up old log files

46,305

No need to use a for-loop here, you can just use find:

sudo find /var/log/ -type f -regex '.*\.[0-9]+\.gz$' -delete

However, as it was suggested, check the manual page of logrotate for ways to reduce the number of files.

Share:
46,305

Related videos on Youtube

DiogoSaraiva
Author by

DiogoSaraiva

Updated on September 18, 2022

Comments

  • DiogoSaraiva
    DiogoSaraiva almost 2 years

    I was trying to automate some auto cleaning of my Ubuntu System, with Cron Jobs

    I tryed to simplify this:

    sudo find /var/log -type f -name "*.1.gz" -delete
    sudo find /var/log -type f -name "*.2.gz" -delete
    sudo find /var/log -type f -name "*.3.gz" -delete
    sudo find /var/log -type f -name "*.4.gz" -delete
    ,etc...
    

    into one command like this below but is not working, probably because I don't know...

    for i=[^0-9]; sudo find /var/log -type f -name "*.$i.gz"
    

    I tried similar ones but didn't worked too... :

    $i=[^0-9]; sudo find /var/log -type f -name "*.$i.gz"
    i=[^0-9]; sudo find /var/log -type f -name "*.$i.gz"
    i=[^0-9]+$; sudo find /var/log -type f -name "*.$i.gz"
    

    I can't see any output with this last four ones... and someones produces errors...

    So what is the correct command / syntax?
    And any other ideas to keep my "mini" server clean?

    Other question: If I run sudo find / -type f -name "*.7.gz"
    will appear this one:
    "/usr/share/doc/libruby1.9.1/NEWS-1.8.7.gz"

    I can solve with this:

    if I run: sudo find / -type f -name "*log.7.gz"
    BUT I will probably skip those with *error.(0-9).gz extension and many others...

    Any idea to clean old logs under / without find/remove like these ones: "/usr/share/doc/libruby1.9.1/NEWS-1.8.7.gz"

    EDIT

    in my /etc/logrotate.d are:

    /var/log/apache2/*.log {
        weekly
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 640 root adm
        sharedscripts
        postrotate
                    if /etc/init.d/apache2 status > /dev/null ; then \
                        /etc/init.d/apache2 reload > /dev/null; \
                    fi;
        endscript
        prerotate
            if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                run-parts /etc/logrotate.d/httpd-prerotate; \
            fi; \
        endscript
    }
    /var/log/apport.log {
           daily
           rotate 7
           delaycompress
           compress
           notifempty
           missingok
    }
    
    /var/log/apt/term.log {
      rotate 12
      monthly
      compress
      missingok
      notifempty
    }
    
    /var/log/apt/history.log {
      rotate 12
      monthly
      compress
      missingok
      notifempty
    }
    
    /var/log/aptitude {
      rotate 6
      monthly
      compress
      missingok
      notifempty
    }
    /var/log/cups/*log {
        daily
        missingok
        rotate 7
        sharedscripts
        prerotate
            if [ -e /var/run/cups/cupsd.pid ]; then
                invoke-rc.d --quiet cups stop > /dev/null
                touch /var/run/cups/cupsd.stopped
            fi
        endscript
        postrotate
            if [ -e /var/run/cups/cupsd.stopped ]; then
                rm /var/run/cups/cupsd.stopped
                invoke-rc.d --quiet cups start > /dev/null
                sleep 10
            fi
        endscript
        compress
        notifempty
        create
    }
    /var/log/dpkg.log {
        monthly
        rotate 12
        compress
        delaycompress
        missingok
        notifempty
        create 644 root root
    }
    /var/log/alternatives.log {
        monthly
        rotate 12
        compress
        delaycompress
        missingok
        notifempty
        create 644 root root
    }
    # - I put everything in one block and added sharedscripts, so that mysql gets 
    #   flush-logs'd only once.
    #   Else the binary logs would automatically increase by n times every day.
    /var/log/mysql.log /var/log/mysql/mysql.log /var/log/mysql/mysql-slow.log /var/log/mysql/error.log {
        daily
        rotate 7
        missingok
        create 640 mysql adm
        compress
        sharedscripts
        postrotate
            test -x /usr/bin/mysqladmin || exit 0
            # If this fails, check debian.conf! 
            MYADMIN="/usr/bin/mysqladmin --defaults-file=/etc/mysql/debian.cnf"
            if [ -z "`$MYADMIN ping 2>/dev/null`" ]; then
              # Really no mysqld or rather a missing debian-sys-maint user?
              # If this occurs and is not a error please report a bug.
              #if ps cax | grep -q mysqld; then
              if killall -q -s0 -umysql mysqld; then
                exit 1
              fi 
            else
              $MYADMIN flush-logs
            fi
        endscript
    }
    /var/log/pm-suspend.log /var/log/pm-powersave.log {
           monthly
           rotate 4
           delaycompress
           compress
           notifempty
           missingok
    }
    /var/log/ppp-connect-errors {
        weekly
        rotate 4
        missingok
        notifempty
        compress
        nocreate
    }
    
    /var/log/syslog
    {
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
            reload rsyslog >/dev/null 2>&1 || true
        endscript
    }
    
    /var/log/mail.info
    /var/log/mail.warn
    /var/log/mail.err
    /var/log/mail.log
    /var/log/daemon.log
    /var/log/kern.log
    /var/log/auth.log
    /var/log/user.log
    /var/log/lpr.log
    /var/log/cron.log
    /var/log/debug
    /var/log/messages
    {
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
            reload rsyslog >/dev/null 2>&1 || true
        endscript
    }
    /var/log/speech-dispatcher/speech-dispatcher.log /var/log/speech-dispatcher/speech-dispatcher-protocol.log {
      daily
      compress
      missingok
      sharedscripts
      rotate 7
      postrotate
        /etc/init.d/speech-dispatcher reload >/dev/null
      endscript
    }
    
    /var/log/speech-dispatcher/debug-epos-generic /var/log/speech-dispatcher/debug-festival /var/log/speech-dispatcher/debug-flite {
      daily
      compress
      missingok
      sharedscripts
      rotate 2
      postrotate
        /etc/init.d/speech-dispatcher reload >/dev/null
      endscript
    }
    /var/log/ufw.log
    {
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
            invoke-rc.d rsyslog reload >/dev/null 2>&1 || true
        endscript
    }
    /var/log/unattended-upgrades/unattended-upgrades.log 
    /var/log/unattended-upgrades/unattended-upgrades-shutdown.log
    {
      rotate 6
      monthly
      compress
      missingok
      notifempty
    }
    /var/log/upstart/*.log {
            daily
            missingok
            rotate 7
            compress
            notifempty
        nocreate
    }
    /var/log/vsftpd.log
    {
        create 640 root adm
    
        # ftpd doesn't handle SIGHUP properly
        missingok
        notifempty
        rotate 4
        weekly
    }
    

    and in /etc/logrotate.conf:

    # see "man logrotate" for details
    # rotate log files weekly
    weekly
    
    # use the syslog group by default, since this is the owning group
    # of /var/log/syslog.
    su root syslog
    
    # keep 4 weeks worth of backlogs
    rotate 4
    
    # create new (empty) log files after rotating old ones
    create
    
    # uncomment this if you want your log files compressed
    #compress
    
    # packages drop log rotation information into this directory
    include /etc/logrotate.d
    
    # no packages own wtmp, or btmp -- we'll rotate them here
    /var/log/wtmp {
        missingok
        monthly
        create 0664 root utmp
        rotate 1
    }
    
    /var/log/btmp {
        missingok
        monthly
        create 0660 root utmp
        rotate 1
    }
    
    # system-specific logs may be configured here
    

    Can I set up to 100k rotate 3 all logs per example? How? and how much logs will last at minimum with that configuration?

    • Stephen Kitt
      Stephen Kitt over 9 years
      logrotate is designed to manage your logs for you; it's probably already installed on your system. Have a look at its documentation to reduce the number of log files it keeps... Reducing the value after rotate in /etc/logrotate.conf should be sufficient.