FreeBSD 12 – /var/log Growth Fills Root Filesystem – Log Retention and Rotation Controls

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Root filesystem reaches critical utilization, causing service interruptions and failed package updates.

Environment & Reproduction

High-volume daemon logs and weak rotation limits in newsyslog configuration.

df -h
du -sh /var/log/* | sort -h

Root Cause Analysis

Aggressive log generation plus permissive rotation policy allows unbounded growth.

Quick Triage

Identify top log consumers and verify current rotation schedule.

newsyslog -nvv
ls -lah /var/log

Step-by-Step Diagnosis

Inspect noisy service patterns and current retention settings.

cat /etc/newsyslog.conf
grep -R "newsyslog" /etc/newsyslog.conf.d 2>/dev/null

Solution – Primary Fix

Rotate and compress logs immediately, then tighten retention policy.

newsyslog -F
vi /etc/newsyslog.conf
service syslogd reload

Solution – Alternative Approaches

Ship logs to centralized storage and keep minimal local retention windows.

Verification & Acceptance Criteria

Disk usage returns below threshold and remains stable over normal traffic cycles.

df -h
du -sh /var/log/* | sort -h

Rollback Plan

Revert newsyslog policy if retention reduction conflicts with audit requirements.

Prevention & Hardening

Add filesystem and log growth alerts with periodic rotation audits.

Related Errors & Cross-Refs

No space left on device, cannot write log file, root filesystem full.

Related tutorial: View the step-by-step tutorial for freebsd-12.

View all freebsd-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

newsyslog(8), syslogd(8), and FreeBSD logging/operations best practices.