If you have a bunch of logwatch folders under some directory, most likely under /var/cache/logwatch/ that are filling up your server, you should fix it before it brings your server down. Often this can cause the disks to fill up in just a month or two, maybe less. If logwatch is causing your disks to fill up, keep reading.
If you are asking yourself: How do I find out if logwatch is filling up my server? The answer is:
- Look at your logwatch configuration files to determine where the TmpDir is set to
- Go to that tmp directory, and run this command:
du -sm ./*
From here, you can use your brain to determine if that directory is the problem. Remember, the df command shows your total disk space usage:
df
Okay, now you’ve determined that logwatch files are the problem,. Are you asking yourself one of these questions?
- Why are these logwatch files filling up my server?
- Why are these logwatch files not getting deleted?
- How do I fix this so logwatch files get deleted from now on?
- Is it okay to delete all of these logwatch files?
- How do I delete these logwatch files?
Why are these logwatch files filling up my server?
Why are these logwatch files not getting deleted?
Logwatch by default puts it’s cache files into “/var/cache/logwatch/”. This directory is not under /tmp, so it doesn’t get automatically trimmed.
You should change your configuration file to put these files under /tmp instead. See below.
How do I fix this so logwatch files get deleted from now on?
Under /etc/logwatch/conf/logwatch.conf – set the “TmpDir” to “/tmp”. If /etc/logwatch/conf/logwatch.conf is blank, you may need to copy the default file from /usr/share/logwatch/default.conf/logwatch.conf to /etc/logwatch/conf/logwatch.conf.
Is it okay to delete all of these logwatch files?
How do I delete these logwatch files?
Yes, it is okay. To delete these files, run this command:
rm -rf /var/cache/logwatch/*
Obviously, you will need to adjust the directory if the problem files are somewhere else.
