How can I move /var/log directory
I assume you are unable to simply extend the filesystem in question (using
lvextend && ext2online), because you do not use LVM or use wrong filesystem type.
What you've proposed might work if you signal the daemons with SIGHUP (kill -1 pid). Obviously you would need to later on "mount -o bind / /somewhere" and clean up what has been left underneath mounted /var/log. But it has a bad smell for me, especially for production.
Avoid downtime, have a clean result (but complicated to do)
Forget about "mount -o bind" idea, create a new LV/partition, but don't mount it yet.
lsof | grep /var/log # lists open files in /var/log
For each daemon that has any open file (I would expect at least syslog, inetd, sshd):
- reconfigure the daemon no to log to /var/log
- refresh the daemon (
- confirm with
lsof | grep /var/logthat daemon has closed its files
Mount over /var/log. Restore old configurations, SIGHUP/reload daemons again.
Easy way (downtime)
Create a new LV/partition and mount it properly over either /var or /var/log. The easy way is to take down the server to maintenance mode (single-user mode), and use the actual console (not ssh) for the operation.
Everyone else's answers are excellent and correct, and you should definitely read them first.
I just thought I'd share this because it makes for easy copy-and-paste, if your case turns out to be quite a simple one like mine was:
Stop the syslog and copy current logs out:
service rsyslog stop mkdir -p /tmp/varlog cp -r /var/log/* /tmp/varlog
then, mount your new location over
/var/log. Say it's a new device called
mount /dev/sdb /var/log
now you can copy files back and restart the syslog:
cp -r /tmp/varlog/* /var/log rm -rf /tmp/varlog service rsyslog start
Assuming this all happens quite early on in the life of your machine,
rsyslog is likely to be the only daemon running. YMMV!
PS - you'll be wanting to add it to your
fstab as well probably. Here's one way of doing that, again assuming a very straightforward mount:
cat /etc/mtab |grep /var/log >>/etc/fstab
(cf https://serverfault.com/a/267610/80606 about catting mtab to fstab)
Another thing that you could do is:
- Stop the processes that have open files on
- Verify that there aren't any processes with open files on
lsofas kubanskamac suggested)
- Move your
/var/logto another partition with enough free space (following your example, that would be
- Create a symbolic link from /var/log to /home/log (
ln -s /home/log /var/log)
- Restart the processes that you stopped in the first step
Please note that this is far from what I'd consider as a good practice. It's just a workaround so that you don't have to shutdown the server. The right solution would be to create a new
/var/log partition with enough space (or expand the current one),