Sample Header Ad - 728x90

How to move log files in /var/log/journal to free disk space without losing logs?

0 votes
0 answers
2051 views
I'd like to later check if there is a way / software to easily scan logs for issues one should look into² and if such exists scan all logs, including old logs. This is why for now I'd like to keep the logs of my Debian11/KDE machine rather than just delete them or set a datastorage-limit with e.g. journalctl --vacuum-size=500M. As they're taking lots of disk space on the small root partition, I'd like to move them. **How can I move the log files to another partition (on another drive that isn't always mounted) without causing problems with the ongoing logging and read these logs also from there?** I hope that at some point the above can be carried out within a GUI, preferably KSystemLog, which reads and shows the journal logs from the location they have been move to and the current location on the root partition. ---- So far these two options don't seem to be appropriate as is:
sudo cp /var/log/kern.log /media/..../kern.log
sudo truncate -s 0 /var/log/kern.log
The above would copy the file elsewhere and then truncate the local file, but this doesn't seem to be a good way that allows properly reading the logs etc.
service rsyslog stop
mv /var/log/audit /home/
ln -s /home/audit /var/log/audit
service rsyslog start
The above would create a symbolic link which could be a good approach if the partition was always mounted. ---- (Other related questions that this question is not about would be how to enable limitless logging but at the same time prevent for example many duplicate messages from inflating the logs' file-sizes and which configured-by-default software can to date already smartly scan logs.) ² for example all entries with the type "error", or summaries that combine many similar log entries, or most frequent log-entries, or messages known to be actual problems, or intrusion-attempts, or all security-issue-related entries, ...
Asked by mYnDstrEAm (4708 rep)
Apr 17, 2022, 09:23 AM