[tinysofa-discuss] Lot of logfiles in var/log worries me

[Andrew Shugg]

Hi Benni,

> I just recognized that in my /var/log-dir there are more than 20.000 
> files called log.*, where * is an ip-adress (nearly 20.000 times) or 
> an more or less random string, from some names ('billgates, i.e. ;-) ) 
> to totally random strings like '2j9x3qod2bm8ghd'...

As Morten already said: samba.  The 'culprit' is this line in samba's
config file (/etc/samba/smb.conf):

 log file = /var/log/%m.log

Every time Samba receives a connection from another host it creates a
new log file for it - %m expands to the machine name, so a bare IP
address if a lookup fails, otherwise the hostname of the machine.

If you 'mkdir /var/log/samba' and change the above line to

 log file = /var/log/samba/%m.log

you will at least stop getting crud in /var/log.

> It appears that they are logmessages of the smbd, so I switched the 
> logging of samba of, allthough most of the files were created in 
> 2005... ;-).

You should be more concerned about where all the connections are coming
from.  Is this server facing the public Internet?  If so you should
modify Samba to only respond to requests coming from your internal
network, and/or firewall off all unnecessary ports on your public
interface address.

> But anyway, where do this files come from? And how can I delete them now?
> For Example rm log.84.* doesn't work (/bin/rm: Argument list too long)
> I also tried 'ls | grep log.84 > rm', which should delete every file 
> 'step by step', but it didn't work.

Morten's suggestion is dangerous if taken literally.  Try:

  mkdir /var/log/samba && mv /var/log/log.[ns]mbd /var/log/samba/
  find /var/log/ -maxdepth 1 -type f -name 'log.*' -exec rm {} ';'

Andrew S.

-- 
Andrew Shugg <andrew at neep.com.au>                   http://www.neep.com.au/

"Just remember, Mr Fawlty, there's always someone worse off than yourself."
"Is there?  Well I'd like to meet him.  I could do with a good laugh."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.tinysofa.org/pipermail/tinysofa-discuss/attachments/20060615/995fc3bb/attachment.bin