Logging Service Not Rotating and /var/log Grows Unbounded

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Failed log rotation leads to rapid disk growth and can interrupt core services.

Environment & Reproduction

Large persistent log files remain unrotated and /var usage increases continuously.

Root Cause Analysis

Hosts using syslogd and periodic newsyslog tasks with custom application log definitions.

Quick Triage

Root access and approval to adjust retention and compression policies.

Step-by-Step Diagnosis

[image_ref: 0] Run service syslogd status; newsyslog -nvv; grep newsyslog /etc/crontab; ls -lh /var/log.

Solution – Primary Fix

[image_ref: 1] Validate entries in /etc/newsyslog.conf and any include files for correct owner, mode, and signal directives.

Solution – Alternative Approaches

Fix malformed rotation rules, run newsyslog manually, and reload affected daemons. Enable periodic maintenance tasks if disabled.

Verification & Acceptance Criteria

Log files rotate on schedule, old archives compress correctly, and /var growth normalizes.

Rollback Plan

Revert to previous known-good newsyslog config if custom entries break daemon signaling.

Prevention & Hardening

Review new log paths during application deployment and add rotation entries proactively.

Related Errors & Cross-Refs

Escalate when log storms indicate application faults or security incidents requiring incident response.

Related tutorial: View the step-by-step tutorial for freebsd-14.

View all freebsd-14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

syslogd(8), newsyslog(8), newsyslog.conf(5), periodic(8).