System Logs Not Rotating and /var Grows Rapidly

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

/var/log files expand continuously and old compressed archives are missing.

Environment & Reproduction

Broken newsyslog.conf entries, permission errors, or cron periodic jobs disabled.

Root Cause Analysis

Run newsyslog -nvv and check periodic daily output.

Quick Triage

Force rotation for critical logs and reclaim space carefully.

Step-by-Step Diagnosis

Use newsyslog -Fv and du -sh /var/log before and after forced rotation.

Solution – Primary Fix

Inspect /etc/newsyslog.conf and /etc/syslog.conf for invalid paths or owners.

Solution – Alternative Approaches

Correct rotation policies, verify periodic_enable, and restart syslogd if needed.

Verification & Acceptance Criteria

Confirm new rotated files appear and active logs continue writing.

Rollback Plan

Set size alerts for /var and validate rotation quarterly.

Prevention & Hardening

Restore previous config files and use conservative rotation defaults.

Related Errors & Cross-Refs

Escalate if applications hold file descriptors open and prevent log cycling.

Related tutorial: View the step-by-step tutorial for freebsd-15.

View all freebsd-15 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

newsyslog -nvv; newsyslog -Fv; service syslogd restart; du -sh /var/log