Dave
BEWARE: Removing current(ly opened) logs may confuse some of the running programs, emptying the files instead is safer; hence I would discourage the suggestion by @Dave as too forceful (not even sure if the programs could be able to restore the sub-directory structure which could be created only at install time and implicitly expected to be present ever since).
Indeed, even emptying the files can cause issue with the running program. That is why logrotate/rsyslog can be set to restart services and reset permissions. Yes it is best to properly setup logrotate as abc-nix suggested to avoid the oversized log issue entirely. Also consider reviewing/configuring /etc/rsyslog.conf or whatever other log management program is used.
That said, probably a safer and quick way to cleanup is to RM all *.gz *.xz and \.[0-9]* files leaving only those actively in use. Then if you wanted/needed those emptied use truncate command to completely empty them or cut them to a specified size.
find /var/log -type f -regex ".*\.*z" -delete
find /var/log -type f -regex ".*\.[0-9]$" -delete
find /var/log -type f -exec truncate -s 512000 {} \; But even still there may be issues with different naming conventions (samba for instance)
Rehat doc on logging:
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-viewing_and_managing_log_files
- This reply was modified 5 months, 2 weeks ago by Dave.
Computers are like air conditioners. They work fine until you start opening Windows. ~Author Unknown