Z-Net v2 /var/logs filling up

[drhtmal]

I just noticed that the /var/log file system on my stock HomeSeer Z-Net was at 100% used. I deleted some of the logs that were rotated but it just fills back up in a few days. I don't see anywhere that I can disable various logging. Is there a way to turn down the log levels. I am also replacing the stock flash card with this one

https://www.amazon.com/gp/product/B0...?ie=UTF8&psc=1

[SIZE=12px][FONT=courier new]df -k[/FONT]
[FONT=courier new]Filesystem     1K-blocks    Used Available Use% Mounted on
/dev/root        3748736 1171444   2395404  33% /
devtmpfs          468148       0    468148   0% /dev
tmpfs             472756       0    472756   0% /dev/shm
tmpfs             472756   47668    425088  11% /run
tmpfs             472756       8    472748   1% /run/lock
tmpfs             472756       0    472756   0% /sys/fs/cgroup
tmpfs             472756       0    472756   0% /var/tmp
[COLOR=#FF0000][B]tmpfs               1024    1024         0 100% /var/log[/B][/COLOR]
tmpfs             472756       0    472756   0% /tmp
/dev/mmcblk0p1     64456   22264     42192  35% /boot[/FONT][/SIZE]

[SIZE=12px][FONT=courier new] ls -la
total 976
drwxr-xr-x  3 root root    420 Jun 16 20:45 .
drwxr-xr-x 12 root root   4096 Dec 19 14:25 ..
-rw-r-----  1 root adm  524288 Jun 16 20:45 auth.log
[COLOR=#FF0000][B]-rw-r-----  1 root adm  116133 Apr 24 06:25 auth.log.1[/B][/COLOR]
-rw-r--r--  1 root root   4330 Apr 23 16:02 boot.log
-rw-rw----  1 root utmp      0 Jun  1 06:25 btmp
[COLOR=#FF0000][B]-rw-rw----  1 root utmp      0 May  1 06:25 btmp.1[/B][/COLOR]
-rw-r-----  1 root adm    4096 Jun 16 19:00 daemon.log
[B][COLOR=#FF0000]-rw-r-----  1 root adm   17054 Apr 23 16:16 daemon.log.1
-rw-r-----  1 root adm       0 Apr 28 06:25 daemon.log.1.gz[/COLOR][/B]
-rw-r-----  1 root adm       0 Apr 24 06:25 debug
[B]-rw-r-----  1 root adm    1002 Apr 23 15:17 debug.1[/B]
-rw-r-----  1 root adm       0 Apr 24 06:25 kern.log
drwxr-xr-x  2 root root    100 Apr 28 06:25 lighttpd
-rw-r-----  1 root adm   98304 Jun 16 20:45 messages
[COLOR=#FF0000][B]-rw-r-----  1 root adm   43953 Apr 24 06:25 messages.1[/B][/COLOR]
-rw-r-----  1 root adm   77824 Jun 16 20:45 syslog
[COLOR=#FF0000][B]-rw-r-----  1 root adm   93817 Apr 26 06:25 syslog.1[/B][/COLOR]
-rw-r-----  1 root adm       0 May 13 12:21 user.log
-rw-rw-r--  1 root utmp      0 Jun  8 18:05 wtmp
[COLOR=#FF0000][B]-rw-rw-r--  1 root utmp      0 May  1 06:25 wtmp.1[/B][/COLOR][/FONT][/SIZE]

[zwolfpack]

HS makes some "interesting" choices in their builds. On the Z-Net, they mapped /var/log to tmpfs i.e. RAM disk. Guessing the idea was to reduce wear on the SD card. Then on later editions it seems that they cut the partition size down considerably.

Take a look at /etc/fstab. Here is what was on an early Z-Net v2

proc            /proc           proc    defaults                    0   0
/dev/mmcblk0p1  /boot           vfat    defaults                    0   2
/dev/mmcblk0p2  /               ext4    defaults,noatime            0   1
tmpfs          /tmp             tmpfs   defaults,noatime,size=100m  0   0
[COLOR=#FF0000]tmpfs          /var/log         tmpfs   defaults,noatime,size=100m  0   0[/COLOR]
# a swapfile is not a swap partition, no line here
#   use  dphys-swapfile swap[on|off]  for that

Note that here the /var/log size is 100MB. From your "df" results, it appears that it's less on yours.

An issue I have with mapping the /var/log to RAM is that the logs won't be available after reboot. This eliminates a big reason for having logs! An alternate approach might have been to eliminate routine log entries that have little value. A good start in this direction is to turn off cron logging. On the Z-Net, they run a cron job every five minutes to update the find.homeseer.com database. Each of these writes a useless status entry to multiple log files. To eliminate this, create a file in /etc/rsyslog.d/cron.conf with this contents:

# mute info messages generated by cron jobs
cron,authpriv.info              ~

After reboot, monitor the update times on the /var/log files and see if there are any that are being updated frequently. As I recall, the cron entries were the heavy hitters and I don't think I had to do anything more after that.

Also if desired you can increase the /var/log tmpfs size in /etc/fstab, or even remove that line entirely so the logs are saved on the SD card (that's how a standard Raspberry Pi is configured).

[lveatch]

I have znet's /etc/rsyslog.conf set to forward events to my local centralized syslog server.

auth,authpriv.*                 @192.168.1.24:514
#auth,authpriv.*                        /var/log/auth.log
*.*;auth,authpriv.none          @192.168.1.24:514
#*.*;auth,authpriv.none         -/var/log/syslog
#cron.*                         /var/log/cron.log

[drhtmal]

zwolfpack and lveatch , thanks for the quick reply.

I did notice all the find.homeseer.com entries every 5 minutes that were filling up the log. I have my Z-Net on a static IP so I really don't need the find.homeseer feature.

I think I will just redirect the log messages to my main HS box. It has ample hard drive space.

FYI. Here is what the fstab on my Z-Net looks like.

[FONT=courier new]proc            /proc           proc    defaults          0       0
/dev/mmcblk0p1  /boot           vfat    defaults          0       2
/dev/mmcblk0p2  /               ext4    defaults,noatime  0       1
tmpfs /tmp tmpfs defaults,noatime 0 0
[COLOR=#FF0000]tmpfs /var/log tmpfs size=1M,noatime 0 0[/COLOR]
tmpfs /var/lock tmpfs defaults,noatime 0 0
tmpfs /var/tmp tmpfs defaults,noatime 0 0[/FONT]