XYMer's Home away from Home

Puzzled.

Been reading some discussion about the System Logs getting huge due to runaway error logging. Wondering how this happens. Some attribute this to the periodic scripts never getting run if the computer isn't awake at the right time, and even though in Leopard they should get run at the next opportunity, this doesn't happen. For example, checked and saw that my periodic scripts (Leopard) hadn't been run for more than two and a 1/2 months But, I've been reading that those scripts, at least in Leopard, don't remove or deal with the System Logs anyway. So according to that, whether those scripts get run or or not is irrelevant to the problem of runaway logs.

What I have seen is syslogd, not the periodics, is supposed to turn them over and limit them to a certain size. But also read somewhere this also is scheduled only for a specified hour, maybe midnight, so that might explain how these logs might be allowed to become huge. Someone using Leopard had 70GB System Logs.

http://reviews.cnet.com/8301-13727_7-10329637-263.html

The periodic scripts are three sets of scripts that perform minor housekeeping periodically. The three scripts are daily, weekly, and monthly, running as you might guess at those intervals. By default daily runs at 3:15 AM, weekly at 3:15 AM, and monthly at 5:30 AM. Each of these functions may have several sub-scripts that are executed to perform different tasks. The individual scripts are stored in /etc/periodic, then the appropriate subfolders thereof.

The daily periodic scripts, among other things, rotates, compresses, and deletes old logs in some folders, such as /var/log. The script that actually does the work is /private/etc/periodic/daily/100.clean-logs and it, like its fellow periodic scripts, is configured by the file /etc/defaults/periodic.conf.

I've had lots of experience with runaway log files, but never had any get larger than about 600 MB, which is still pretty big. Basically, something that runs frequently, like every second or every few seconds, fails and logs a result. These rapidly build up.

You can manually delete large logs if necessary, but if you do, it would be a good idea to recreate the deleted log file just in case something tries to append something to it without trying to create it first. For example, if you suddenly discover your system.log is taking up 300 MB, you can delete it:
sudo rm /var/log/system.log

Then recreate an empty file in its place with the appropriate permissions:
sudo touch /var/log/system.log
sudo chown root:admin /var/log/system.log
sudo chmod 640 /var/log/system.log

NOTE: sudo tells the computer to run the command as the supersuser. This is important because the root user owns these files. The rm command deletes the given file (it is a powerful command, one not to be trifled with -- especially when run as root!). The touch command tells the computer to create a new empty file, or set the date and time to the present on the requested file if it's already there. The chown command tells the computer which user and group should own the file, in this case root and the admin group. Finally, the chmod command changes the permissions on the file so that root can read and write to it, the admin group can read it, and no one else can do anything with it.

I hope that's useful or interesting, but I realize it may be neither.

- Anonymous

Thanks, much useful and interesting information. Especially useful, the way of leaving the file empty after deleting its contents in case it needs to be written to. (Wonder if using a utility like Onyx to delete log files will delete the contents that way, leaving the file still there but empty?)

But several questions remain: When I checked to see the last time any of these scripts ran using ls -al /var/log/*.out I saw that none of them had been run for two and a half months (the computer is shutdown at these times). They are supposed to run anyway in Leopard, at the next opportunity, right? Doesn't happen, so I've been doing it manually now.

But what I don't understand is I remember seeing that they were getting turned over during this period, at least sometimes. What was doing that? Was that syslogd? What is its function? Is that duplicating what periodic daily does? Does syslogd execute to turn over logs at a set time, and is it independent of the period scripts; i.e. will the System Logs get turned over, if needed, if the computer is on at midnight, even if the periodic scripts never run? And if syslogd is assigned to do that, then how can logs grow out of control?

The System Logs, among others, reside in /var/log, so whoever said the periodic scripts don't address the System Logs in Leopard is wrong then, correct?

Dr Smoke...

http://www.thexlab.com/faqs/maintscripts.html

Dave Taylor...

http://www.askdavetaylor.com/fixing_mac ... mmand.html

Have seen Smoke's before but don't know if these articles answer the question above about syslogd, and why my logs turned over (I think they did) even though scripts hadn't run for months. Thanks BD.