var partition is too small

[Jens Rehsack]

Redmond Militante wrote:
> hi all
> 
> the var partition on my apache box may be too small.
> this is a problem because - 
> i originally had newsyslog set at
> 
> /var/log/httpd-access.log               644  7     100  24    B /var/run/httpd.pid 30
> 
> which sets httpd-access.log to be rotated in binary format everytime it reaches 100 mb or once every hour for 24 hours.
> which basically means we only archive less than a day's worth of httpd-access.log's on this machine...
> 
> 
> the /var partition on this machine is 252 mb.

Looks like sysinstalls defaults.
Maybe this should be fixed some fine day :-)

> yesterday i was told asked to start archiving httpd-access.logs for analysis over longer periods of time - that i should be keeping a year's worth of logs, if possible.  i remember the original reason i set up newsyslog.conf to rotate httpd-access.logs on this machine so frequently is because the webserver is really busy, and this file tends to grow pretty rapidly, and i didn't want to have to log in, stop apache, and archive the logs by hand every day...
> 
> yesterday i looked into expanding the size of my /var partition by symlinking.
> 
> -drop to single user mode
> -stop syslogd
> -mv /var to /usr/var
> -umount /var
> -delete /var directory
> -create symlink from /usr/var to /var

That's really bad, because this means that there will be permanent
write accesses to you /usr label.

A better way could be a cron job which moves the old http-logs
once a day into a place in /usr, eg. /usr/save-logs.

> it seems easy, and i did it successfully once, but i hosed a (non)production box yesterday practicing the above procedure.
> 
> i have a number of questions:
> -if i copy the contents of /var to /usr/var, then delete the var directory, do i need to modify my fstab?

If you've done it as described, that would be better.
But I think you should re-think about the procedure.

> my fstab right now looks like
> 
> /dev/aacd0s1g           /usr            ufs     rw              2       2
> /dev/aacd0s1e           /var            ufs     rw              2       2
> 
> -do i need to modify this so that /var now points to a directory inside /usr? and how?
> -i'm thinking that this may be too risky a procedure to try on a production box (i guess i'm spooked from ruining the practice box...) - anyone think i should just archive these logs by hand to someplace in my home directory (/usr is very large on this box - 65 gb - and hardly used)?  my goal is basically to keep an archive of httpd-access.logs for as long as possible to produce a comprehensive webalizer report...
> 
> thanks again
> 
> redmond

Best,
Jens