help-cfengine
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Way too many logs being created.


From: Wil Cooley
Subject: Re: Way too many logs being created.
Date: Sat, 30 Jul 2005 23:44:55 -0700

On Sat, 2005-07-30 at 18:01 -0700, Rick Philbrick wrote:
> Hi,
> 
> I am babysitting a few boxes that have cfengine running.  These boxes
> are filling up a 1gig partion with messages in the
> /var/cfengine/outputs dir.   How can I get it to stop doing this.  I
> think the guy who did the install recently didn't do any fine tuning.  The fix
> ,for now ,  is to go in and clear the dir, but to be honest thats
> getting old.
> 
> I haven't done any work with cfengine and am hoping this a matter of
> editing a line a config file somewhere..... where is such file and
> what line/s do i edit??

Not any particular file (other than perhaps cfagent.conf or update.conf,
or any more appropriate files that get imported), but you can use the
'tidy' action sequence to prune the logs back.  You probably will also
want to attend to whatever is causing so much logging.  I recently had a
bunch of servers have problems resolving user and group names due to a
failure of Samba's winbindd, caused ultimately by upgrades on the
Windows domain controllers.  I have a number of directories with many
files that cfengine runs through to check ownership and this caused a
tremendous number of 'unknown user "foo"' log entries, resulting in
600MB of logs on each host over a weekend.  You might be experiencing
something similar, which is fairly easy to fix.  (It might be nice if
cfengine had a mechanism like the Linux syslogd [and probably others],
such that a large number of identical log entries are collapsed into
'last message repeated N times'.)

Wil
-- 
Wil Cooley                                 wcooley@nakedape.cc
Naked Ape Consulting                        http://nakedape.cc
* * * * Linux, UNIX, Networking and Security Solutions * * * *

Attachment: signature.asc
Description: This is a digitally signed message part


reply via email to

[Prev in Thread] Current Thread [Next in Thread]