Now-a-days cheap VPS’s are very much available. Usually these cheap VPS’s provides very low resources. Minimum reasonable disk space, very low CPU share, 32 to 128 MB RAM. Main problem with low resources is that these fills up very quickly with logs. It would be very beneficial for these systems if the logs may be stopped or at-least minimized. And the logging also takes quite a bit CPU percentage.
By default Linux systems log very extensively for all the services running. In general we should not stop the logging service altogether. Though it’s possible by invoking the command
service rsyslog stop [in this article we are mostly discussing about Ubuntu]. Lot of services may depend on this, as this is one of the core services of the OS.
But we can stop this logging altogether, keeping the
rsyslog service running. Open the file
/etc/rsyslog.conf and comment the line
$IncludeConfig /etc/rsyslog.d/*.conf. Restart the service by
service rsyslog restart or
systemctl restart rsyslog. Check the status whether it’s running
service rsyslog status.
journal may show complain from
rsyslog that, it has not found any viable configurations to log. That’s okay.
Another service for logging and therefore responsible for filling disk is
journalctl. For this look for the services that are running. For
systemd the services resides, if not otherwised customised in
/etc/systemd/system. We can check those files if they contains any command for potential logging. In my case I run
Shadowsocks to create secure proxy. I’ve configured this with the help of the documents from linode. But in the script for running
Shadowsocks as service, they have started and stopped the service with
-v flag. With this flag,
Shadowsocks logs each and every connections, that are being made through it. It kind of objects the purpose of using
Shadowsocks. Moreover increases the log. Anyways it’s better to have it without the
ExecStart=/usr/local/bin/ss-server -c /etc/shadowsocks/shadowsocks.json -a shadowsocks -v start
Also it would be best if nothing comes out of
stop. So let’s dump all to
/dev/null. So the commands would be,
ExecStart=/usr/local/bin/ss-server -c /etc/shadowsocks/shadowsocks.json -a shadowsocks start > /dev/null
To minimize the logs from
journalctl, it’s very helpful to run a
cron daily with the following script.
Save the file in the
home directory, add execution permission by
chmod +x clear_logs.sh and set the
crontab -e. And add one line like
0 22 * * * /root/cron_Jobs/clearlogs.sh. It would run the file once at 10PM.
Another source of logs are from web servers. For Nginx we can stop the logging by adding the following lines to the server block.
By convention the services stores the log files inside the directory
/var/log. Sometimes it’s helpful to check the sizes of the directories inside this. To have consolidated size of a directory use
du -sh <directory_name>. To see the running log for a file, suppose
tail -f /var/log/syslog. And to see the available disk space of the system