Moving /var/log to a different drive under CentOS 7

A quick how-to with the set of instructions to move /var/log partition to a different drive. Done on CentOS 7.5.1804 with all partitions managed by LVM, while /var/log is moved to a USB key.

The tricky part with /var/log is that there is always something being written to it, and although simple archive/restore might work, you risk to lose changes from the moment you create archive till the moment you restore it. Depending on how big /var/log is it could be minutes/hours of data. The procedure below assumes an outage since it will be performed offline, however it assures that no data will be lost.

First, get the Minimal CentOS 7 ISO image from the closest mirror. Luckily, the Minimal ISO contains all necessary tools needed.

Boot from the Minimal ISO, and at the boot prompt choose Troubleshooting, then Rescue a CentOS system, followed by Skip to shell.

Scan for existing LVM groups and volumes:

  1. % lvm vgscan -v
  2.  
  3.    Wiping cache of LVM-capable devices
  4.    Wiping internal VG cache
  5. Reading volume groups from cache.
  6. Found volume group “centos7-tmpl” using metadata type lvm2

Activate all logical volumes in the group:

  1. % lvm vgchange –a y
  2.  
  3.    5 logical volume(s) in volume group “centos7-tmpl” now active

Get the names of activated volumes:

  1. % lvm lvscan
  2.  
  3. ACTIVE  ‘/dev/centos7-tmpl/root’        [<3.73 GiB] inherit
  4. ACTIVE  ‘/dev/centos7-tmpl/swap’        [1.86 GiB] inherit
  5. ACTIVE  ‘/dev/centos7-tmpl/usr’         [<4.66 GiB] inherit
  6. ACTIVE  ‘/dev/centos7-tmpl/tmp’         [488.00 MiB] inherit
  7. ACTIVE  ‘/dev/centos7-tmpl/var’         [8.38 GiB] inherit

Attach and identify the USB key:

  1. % dmesg | grep -i kingston
  2.  
  3. [    5.337421] usb 4-6: Manufacturer: Kingston
  4. [    6.392790] scsi 3:0:0:0: Direct-Access     Kingston DT Workspace     KS13 PQ: 0 ANSI: 6
  5.  
  6. % dmesg | grep -i 3:0:0:0
  7.  
  8. [    6.392790] scsi 3:0:0:0: Direct-Access     Kingston DT Workspace     KS13 PQ: 0 ANSI: 6
  9. [   11.634432] sd 3:0:0:0: [sdo] 60974698 512-byte logical blocks: (31.2 GB/29.0 GiB)
  10. [   11.634726] sd 3:0:0:0: [sdo] Write Protect is off
  11. [   11.634729] sd 3:0:0:0: [sdo] Mode Sense: 2b 00 10 08
  12. [   11.635069] sd 3:0:0:0: [sdo] Write cache: enabled, read cache: enabled, supports DPO and FUA
  13. [   11.639422] sd 3:0:0:0: [sdo] Attached SCSI disk
  14. [   16.221124] sd 3:0:0:0: Attached scsi generic sg15 type 0

Partition and format the USB key if needed.

Mount /root and /var partitions along with the USB key:

  1. % mkdir /mnt/root /mnt/oldvarlog /mnt/newvarlog
  2. % mount /dev/centos7-tmpl/root /mnt/root
  3. % mount /dev/centos7-tmpl/var /mnt/oldvarlog
  4. % mount /dev/sdo1 /mnt/newvarlog

Sync the old /var/log to the USB key. Note that there is a trailing slash at the end of both paths — without it you will end up with /mnt/newvarlog/log (/var/log/log/ while mounted):

  1. % rsync –a /mnt/oldvarlog/log/ /mnt/newvarlog/

Backup the old /var/log to be on a safe side:

  1. % mv /mnt/oldvarlog/log /mnt/oldvarlog/log.old

Edit fstab file to indicate a new drive for /var/log, and reboot with the ISO file detached:

  1. % vi /mnt/root/etc/fstab
  2. /dev/sdo1     /var/log        xfs     defaults        0 0

Confirm that /var/log is indeed populated with the recent entries. /var/log.old could be safely deleted afterwards.

Tags: , , , , ,

This entry was posted on Saturday, July 14th, 2018 at 2:35 pm and is filed under centos, hadoop, tech. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Leave a Reply