Since I know I am not the first (or the last) to make a typo in logrotate and not catch it for a while…someone else must have been in the position of having to delete a lot of files in the same manner. I recently learned that, as usual, there is more than one way to handle it.
To put the situation in context, I basically allowed thousands of mail.* files to be created. These files littered the /var/log/ directory and basically slowed down the entire file system access. I figured out this a number of ways.
The first way was when I tried to do an ls anywhere, it would just hang. My first reaction was to check to see what was eating up the CPU. To do this, I did a top. I noticed that logrotate was hogging all the CPU cycles. Since I know that logrotate basically only operates on one parent directory (by default) /var/log, I headed on over there and did an ls. Once again, it just hung. Then I figured the file system was slow and decided to check out some file system information. The next two commands I ran were df -h and df -i. I ran the df -h to see if we were out of disk space (and yes I lazily use human readable format). I ran the second to check to see how many inodes were in use. (For more information on inodes, check out the wikipedia entry here).
Now that I know the system is short on inodes, I checked out the output of lsof. Now I know that we have some serious problems in the /var/log dir. After some quick investigation, I realized that there were too many mail.* files. How do I get rid of them? Glad you asked… Let’s assume that we want to delete ALL the mail.* files in the /var/log directory.
1) The easiest way is to do it with find:
1a) Using find‘s delete command:
1 | [root@eric] /var/log # find ./ -type f -name "mail.*" -delete |
or
1b) using find‘s exec command with rm:
1 | [root@eric] /var/log # find ./ -type f -name "mail.*" -exec rm -rf '{}' \; |
These will work, but either will be slow since they doesn’t do batch execution.
2) A slightly more preferred way is to use bash:
1 | [root@eric] /var/log # for n in mail.*; do rm -v $n; done; |
This is a little faster, but will still be relatively slow since there is no batch execution. (Note: The -v in the rm will cause quite a bit of output since it is showing you EVERY file it deletes. Feel free to leave this out if you really screwed up.)
3) The actual preferred method is to use find:
1 | [root@eric] /var/log # find ./ -type f -name "mail.*" | xargs rm -f |
I believe this is the preferred method because although it removes the files one at a time, it is more efficient for the file system since it batches it up.
There are certainly other ways to accomplish this task. It can always be done with a Perl one-liner or even using some Perl modules to save some time. These are just a few ideas to point someone in the right direction.
