Bruno Boettcher <[EMAIL PROTECTED]> writes: > > You really should find the real problem before you try changing > > logging. Try something like the command 'find /var -xdev -size +5000k > > -print'. This will print out the names of all files more than 5MB > > (there probably shouldn't be any). Then look into the file and see if > right.... found another big file.. daemon > and lots of > > May 21 19:02:17 erm1 nmbd[8560]: refused connect from 130.79.74.176 > May 21 19:02:22 erm1 nmbd[8569]: refused connect from 130.79.74.176 > May 21 19:02:27 erm1 nmbd[8575]: refused connect from 130.79.74.176 > May 21 19:02:32 erm1 nmbd[8584]: refused connect from 130.79.74.176
That will probably cause a few MB, but I don't think it will be 60MB as you mentioned earlier. I don't know how you shut it off. > > there is some statement that is repeated excessively. You probably > > have something mis-configured so that an error message is constantly > > being logged, possibly multiple times per second. If you can't figure > > out the message, then come back and somebody will probably be able to > > help you. > i already looked at the mail-logs, and they seem reasonable.... no errors, > only correct infos... My /var/log directory is only a little over 2MB, but mine is mostly just a workstation for me. Just for reference, I only have 5 files over 100KB, and the largest is only 300KB. Since you are asking about qmail, I am assuming that you must handle large amounts of mail, so their logs are most of your size. Going back to your original questions, you can check into the log file rotations by looking at the /etc/cron.*/syslog to find the current log rotation options. You can check what is logged into each file by looking at the /etc/syslog.conf file. Check the syslog.conf manpage if you don't understand it. I don't use qmail, so I can't help you except that to suggest you check the config files for qmail. 'dpkg -s qmail' should tell you what they are. If you really are handling enough mail volume to fill 10s of MB, then you may just have to use a large /var directory. One idea you might want to try is to compare the used size from 'df /var' with the result from 'df -sx /var' and see if they are roughly the same. If they are not, then you might have something that has unlinked an active log file. I hope these give you some ideas, otherwise I don't think I can help any more. -- Carl Johnson [EMAIL PROTECTED]
