What is the right approach to purge /var/spool/abrt/

Question

We want to automate the process of removing old directories from /var/spool/abrt/.

We have RHEL machines - version 7.x.

The known way is to do the following

# systemctl stop abrtd
# systemctl stop abrt-oops

And we can remove all those directories and files with following rm command:

# abrt-cli rm /var/spool/abrt/*

And then start the services

# systemctl start abrtd
# systemctl start abrt-oops

We want to simplify the deletion process as the following -- it will delete the directories that are older than 10 days from /var/spool/abrt/

find /var/spool/abrt/  -type d -ctime +10  -exec rm -rf {} \;

Is it a good alternative to purge the /var/spool/abrt/ directory?

Solution 1

Here is my suggestion:

1) Create a shell script /home/yael/purgeabrt.sh

$ cat purgeabrt.sh

#!/bin/bash
set -e
function cleanup()
{
    systemctl start abrtd
    systemctl start abrt-oops
}

trap cleanup EXIT

systemctl stop abrtd
systemctl stop abrt-oops
find /var/spool/abrt/ -type d -ctime +10 -exec abrt-cli rm {} \;
cleanup

2) Run the script as root:

sudo crontab -e

Add the line:

*/5 * * * * bash /home/yael/purgeabrt.sh

in order to execute the cron job every 5 minutes.

Edit:

set -e will terminate the execution of the script if a command exits with a non-zero status.

trap cleanup EXIT will catch signals that may be thrown to the script and executes the cleanup code.

Note: The call to cleanup in the scripts last line is probably unnecessary (redundant) but improves readability of the code.

Solution 2

There should be no need to stop/start the services when using the abrt-cli tool. The full documentation on the tool is here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sect-abrt-cli

Further, you can call the abrt-cli tool to remove individual directories under /var/spool/abrt instead of the wildcard *.

...

Major edit! The rest of my answer was quite mistaken as it attempted to proceed with a combination of the find command and the abrt-cli command. This approach has many problems:

1. the directories under /var/spoo/abrt can themselves have many subdirectories, so the find would need to be restricted by depth
2. the directories do not always have old timestamps, the abrt service must touch some old reports from time to time so find won't always catch all of the old ones.

Comments

[Paulo Tomé]

Would find /var/spool/abrt/ -type d -ctime +10 -exec abrt-cli rm {} \; solve your problem?

[yael]

this is the 1000000$ question

[yael]

what in case service not start or service not stop?

[Paulo Tomé]

See the edited answer.

[yael]

but why not use - find /var/spool/abrt/ -type d -ctime +10 -exec rm -rf {} \; , instead find /var/spool/abrt/ -type d -ctime +10 -exec abrt-cli rm {} \;

[yael]

second , stop/start service each 5 min or little more I think is risky and I prefer to delete the folder without stop/start services - if it possible

[rogerdpack]

Mine caused /var to run entirely out of diskspace...