Directory cleanup on Linux server

Question

A while ago I acquired a small cloud server that is running cloudlinux. I have realized that my disk space is filling up so I ran a command to see which folders or files occupy the most space and this is the list:

1.1G    /usr/tmpDSK
447M    /var/log/btmp-20200401
298M    /var/log/btmp
273M    /var/log/chkservd.log
141M    /var/log/secure-20200329
138M    /var/log/secure-20200406
124M    /var/log/secure-20200419

I don't have much Linux knowledge yet, so I don't know if I can alter some of these files without causing any problems in the system. Should I do this, or look for the cause of the full disk somewhere else?

score 0 · Answer 1 · answered Apr 19 '20 at 15:11

0

Whether a file can be deleted depends on the applications which use that file. Thus there is no universal answer. The search engine of your choice should tell you which service is writing to a certain file.

But in general (not without exception, e.g. Postgres) you can delete everything in /var/log.

If you are unsure then you may use stat for checking the last read (atime) and write (access) times and fuser for checking whether the file is currently opened by any process.

answered Apr 19 '20 at 15:11

Hauke Laging

5,157
2
23
40

You cannot just "delete everything from `/var/log` Some of the services might not start properly after such procedure. – limakzi Apr 19 '20 at 17:02
@limakzi How is that different from what I said? – Hauke Laging Apr 19 '20 at 17:11
and how to debug what services are dealing with these files? – max Apr 19 '20 at 19:15
@max As I said: Search engine. With files which are kept open `fuser` can tell you which process is writing to it. Does not tell you which application might be reading it from time to time. You can get all accesses to a file with the audit system: https://unix.stackexchange.com/questions/186539/how-to-audit-access-to-any-file-or-folder-within-a-given-path-for-specific-user – Hauke Laging Apr 20 '20 at 08:55

score 0 · Answer 2 · answered Apr 19 '20 at 17:10

The problem you faced is pretty common. [rosehosting]

Disk usage analysis.

There are several ways to analyze disk usage. If you want to see your disk usage, take a look at the following topics:

Showing disk usage on Linux with df and du.

df -h

du -sh ./*

You can install a special tool, called ncdu.

Log rotation.

Try to have a separate partition for /var/log.
It is good idea to configure logrotation. Debug current log-rotation. If you have journalctl, apply vacuuming.

You can remove old files, but do it carefully. It may cut forensics possibilities or even break your system. Moreover, it will not solve the root-cause.

Directory cleanup on Linux server

2 Answers2