The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

/var is 80% full due to /var/log/btmp

Discussion in 'General Discussion' started by discovery, Jun 25, 2010.

  1. discovery

    discovery Active Member

    Joined:
    Nov 11, 2008
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    1
    I have this problem with /var getting full

    now I have /var at 80% and the problem is /var/log/btmp file which is taking 1,5G from 2,5G

    can I safely delete this file? guess not.

    any way to safely empty the file?

    I have the rotate logs activated and all other log are rotated nicely.
    Any way to rotate this one too? I think it will be safer to rotate it first and then delete the rotated file.

    Thank you.
     
  2. check45

    check45 Registered

    Joined:
    Dec 19, 2008
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Hello,

    The btmp log keeps track of failed login attempts.
    you can check the logs using command
    last -f /var/log/btmp
    in this logs you can see ip address from which particular action is taken.

    if this file occupies more space on server then you can flush it with following command.

    #echo > /var/log/btmp
     
  3. Indianets

    Indianets Well-Known Member

    Joined:
    Jun 13, 2008
    Messages:
    65
    Likes Received:
    0
    Trophy Points:
    6
    cPanel Access Level:
    Root Administrator
    Hello,

    Once you have got into this trouble, the best way is to move /var/log to your another drive or disk (disk is better IMO) to avoid any such frustration in future.

    I had similar issues and I regretted on having default /var partition size of my DC. I believe cPanel should warn for small /var size as it stores mysql and log.

    You can rsync the log dir to /backup/varlog or similar and then symlink /var/log to /backup/varlog provided /backup is a separate disk. You can stop worrying about /var filled up after this :)

    Anyone has a better resolution, I would love to know as well.

    Thanks,
    Vijay
     
Loading...

Share This Page