Log Files and Size Concerns

[Seasought]

I'm slowly setting up my laptop with better regard to security and logging. My question is this:

The file ipfw.log (and any of the other .log files) are growing rather quickly: can I remove any of these log files (delete them) or rename them for archival reference without breaking anything?

Ideally I'll have things setup to dump the contents of ipfw and system into a separate file that I can review for other purposes as well as run automated checksum comparisons, etc. but that's just extra information that doesn't really pertain to my question.

Thank you.

 

[yellow]

The logfiles are rotated autmatically via the scripts in /etc/periodic/, and launchd (if you're using Tiger) or cron (if you're using Panther/pre-Panther). If you need them rotated now, you should do:

sudo periodic daily

To run just the daily script. You can append monthly and/or weekly, or any combo thereof to that line to run a combonation of the scripts. e.g., "sudo periodic weekly monthly"

I suggest that you learn to deal with the log files where they are, as future OS update will likely break whatever changes you make and you may not even notice. But anyway, you can add a new line in /etc/syslog.conf and point the same things that output to system.log to another file. Make sure the file is in a secure area and isn't editable by anyone but root.

You should also look at what "growing quickly" means... are we talking tens of megabytes a day, or hundred of kilobytes a day? Or more or less? If it's a megabyte a day or less, I wouldn't really worry about it.

 

[Seasought]

Thanks Yellow.