In unix, what's the best way to reduce the size of a massive log file that is actively being written to?

Question

On a linux server, I want to reduce the size of a log file which is several GB big. Cutting off the top half, or maybe the first million lines would work.

ewwhite · Accepted Answer · 2011-03-26T00:46:07.717

13

This comes up in interviews quite often...

Are you looking to truncate the file without disrupting the processes? Is any of the information in the log file valuable? If so, I usually "zero" the file with a simple bash string.

: > /var/log/badlogfile

This comes up in situations where you may have an application that can't be restarted in a controlled manner. Let's say it's a financial trading application and the program can't be halted or restarted during the trading day. However, the log files are growing at some obscene rate due to an application bug. Truncating the log files using the method above or below can keep the system running.

Also see: http://www.cyberciti.biz/faq/truncate-large-text-file-in-unix-linux/

edited Mar 26 '11 at 00:46

answered Mar 26 '11 at 00:35

ewwhite

194,921
91
434
799

1

is the colon supposed to indicate a prompt, or does that actually go into the command? – Phil Mar 26 '11 at 00:47
The colon is part of the command. – ewwhite Mar 26 '11 at 00:55
You don't actually need the colon. – MikeyB Mar 26 '11 at 04:29
It's a no-op. It's not needed, but I like to keep it there when I make the recommendation. – ewwhite Mar 26 '11 at 12:09
This didn't work for me, the log didn't change in size. It went to 0, but then back to its full size – thouliha Sep 09 '15 at 13:22
@thouliha Sorry!!! – ewwhite Sep 09 '15 at 13:22

score 2 · Answer 2 · answered Mar 26 '11 at 00:34

2

You could put it in logrotate, then it won't get out of control as easily

answered Mar 26 '11 at 00:34

netpixie

21
1

Ultimately that needs to happen. I'm new at this job... – Phil Mar 26 '11 at 00:40

score 1 · Answer 3 · answered Mar 26 '11 at 00:54

If it's actively being written to you don't really have much you can do by way of truncate. Your only options are to blank the file (you could copy it elsewhere first.)

echo "" >/var/log/fileYouWantToEmpty

That way the file ends up empty but is still the same file/inode so it won't disrupt the program that is logging.

score 0 · Answer 4 · answered Mar 26 '11 at 04:33

0

You can also try cat /dev/null > /var/log/. But, i have to warn the /dev/null is not implemented in some of the older versions...

answered Mar 26 '11 at 04:33

Software Mechanic

221
1
9

truncating the file doesn't work for me, i did the test on centos 7 and on redhat 5 – c4f4t0r Feb 23 '15 at 15:10

In unix, what's the best way to reduce the size of a massive log file that is actively being written to?

4 Answers4

Linked