Now-a-days cheap VPS’s are very much available. Usually these cheap VPS’s provides very low resources. Minimum reasonable disk space, very low CPU share, 32 to 128 MB RAM. Main problem with low resources is that these fills up very quickly with logs. It would be very beneficial for these systems if the logs may be stopped or at-least minimized. And the logging also takes quite a bit CPU percentage.
By default Linux systems log very extensively for all the services running. In general we should not stop the logging service altogether. Though it’s possible by invoking the command service rsyslog stop [in this article we are mostly discussing about Ubuntu]. Lot of services may depend on this, as this is one of the core services of the OS.
But we can stop this logging altogether, keeping the rsyslog service running. Open the file /etc/rsyslog.conf and comment the line $IncludeConfig /etc/rsyslog.d/*.conf. Restart the service by service rsyslog restart or systemctl restart rsyslog. Check the status whether it’s running service rsyslog status. journal may show complain from rsyslog that, it has not found any viable configurations to log. That’s okay.
Another service for logging and therefore responsible for filling disk is journalctl. For this look for the services that are running. For systemd the services resides, if not otherwised customised in /etc/systemd/system. We can check those files if they contains any command for potential logging. In my case I run Shadowsocks to create secure proxy. I’ve configured this with the help of the documents from linode. But in the script for running Shadowsocks as service, they have started and stopped the service with -v flag. With this flag, Shadowsocks logs each and every connections, that are being made through it. It kind of objects the purpose of using Shadowsocks. Moreover increases the log. Anyways it’s better to have it without the verbose flag.
ExecStart=/usr/local/bin/ss-server -c /etc/shadowsocks/shadowsocks.json -a shadowsocks -v start |
Also it would be best if nothing comes out of start and stop. So let’s dump all to /dev/null. So the commands would be,
ExecStart=/usr/local/bin/ss-server -c /etc/shadowsocks/shadowsocks.json -a shadowsocks start > /dev/null |
To minimize the logs from journalctl, it’s very helpful to run a cron daily with the following script.
#!/bin/bash |
Save the file in the home directory, add execution permission by chmod +x clear_logs.sh and set the cron with crontab -e. And add one line like 0 22 * * * /root/cron_Jobs/clearlogs.sh. It would run the file once at 10PM.
Another source of logs are from web servers. For Nginx we can stop the logging by adding the following lines to the server block.
access_log off; |
By convention the services stores the log files inside the directory /var/log. Sometimes it’s helpful to check the sizes of the directories inside this. To have consolidated size of a directory use du -sh <directory_name>. To see the running log for a file, suppose /var/log/syslog use tail -f /var/log/syslog. And to see the available disk space of the system df -h.