How to change location where logs are stored?

I am running out of space and would like to move my logs to recover some room on my SSD. My question:

  1. I have an SSD (mounted at /) and regular hard-drive (mounted at /mnt/d2). How can I change it so that my logs (all the logs stored in /var/log) are stored somewhere on my other hard-drive (maybe /mnt/d2/var/log)?

Thank you!

Asked By: aaronlevin

sudo /etc/init.d/rsyslog stop
sudo mv /var/log /mnt/d2/
sudo ln -s /mnt/d2/log /var/log
sudo /etc/init.d/rsyslog start

You might want to go ahead and reboot the machine, while you’re at it, just in case you have something other than rsyslogd busily trying to write to logs under /var/log – those won’t recover until they’re restarted as well, which just bouncing the whole box will accomplish nicely.

What we’re doing here is, instead of trying to reconfigure everything that might possibly want to write to /var/log, instead just gently redirecting things going there to your other disk. You can still cd /var/log or less /var/log/syslog or whatever and have it work just fine, this way, and any new programs that try to log to directories under /var/log directly rather than working through rsyslogd will also still work as expected.

Answered By: Jim Salter

I don’t have enough reputation to add this as a comment, so here it is as a necro-answer:

It’s probably better to mount-bind this in your fstab, copy all the logfiles currently in it to the new partition, then reboot. Then clear the old /var/log. Don’t diddle around with symlinks and trying to whack-a-mole running services. You’re gonna have a bad time, eventually.

Answered By: George Puckett

It’s not dead yet.
edit /etc/fstab add line pointing to new directory

/var/log /media/usb-stick/log none bind 0

Then mount all filesystems in fstab:
mount -a

On Ubuntu to force log rotation:
logrotate -vf /etc/logrotate.conf

To test, but not do anything:
logrotate -vdf /etc/logrotate.conf

Answered By: Papillon 8i8
Categories: Answers Tags: , ,
Answers are sorted by their score. The answer accepted by the question owner as the best is marked with
at the top-right corner.