Log File Sizes = HUGE

[samgreco]

I have been trying to track down my growing disk usage and found that zimbra-stats.log is up to 2.1GB and zimbra.log is now a whopping 3.8GB. My entire store is less than 3GB (Only a handful of accounts). I find it curious that 2 of the log files are double the size of the entire mail store

First, can I change the maximum size of those log files? And how can I find out why they aren't rotating?

[uxbod]

Check in /etc/logrotate.d for a zimbra file. By default the logs should rotate on a daily basis.

[samgreco]

Thanks for the amazingly fast response.

I did check that and it is set to daily.

[samgreco]

Also, is there a setting for the level of detail in these logs?

[uxbod]

Check the permissions on the existing files ... they should be

[root@office logrotate.d]# ls -l /var/log/zimbra*
-rw-r--r-- 1 zimbra zimbra   217027 Apr 13 16:08 /var/log/zimbra.log
-rw-r--r-- 1 zimbra zimbra 16897168 Apr 13 16:09 /var/log/zimbra-stats.log

You should also check that logrotate is set to run from /etc/cron.daily.

[samgreco]

Yes, that is exactly the permissions set. And logrotate is set to run every night.

[uxbod]

On the current file check the top record

head /var/log/zimbra.log

Has it rolled over at all ? Are you just processing a huge amount of email ?

[samgreco]

The head shows April 1 which I am assuming is this past April 1. So there must be some rotation happening.

No, I am not processing a lot of mail. There are actually only 2 of us on this server. I have 6 or so accounts for my business and a couple of websites that I run. And my wife has 3 or so accounts. Truly nothing major in email counts.

So I am thinking that I will stop Zimbra, clear those logs and then watch for a bit and see how fast they grow.

[uxbod]

Is cron running ?

ps aux | grep cron

[samgreco]

Yes. Cron jobs have been running without fail near as I can tell. I get my nightly logwatch and admin email reports and a cron message. The logs are the only thing that have been an issue.

I've just cleared the logs and restarted the server. I'll watch a bit and see where it goes.

Thanks again for all your help.