title: why the /var/log/ folder is full
body: <p>I recently found my linux test server /var/log/ is full, it has used 3.8g. But when I list the files in it, it only shows around 800M.</p>
  <p><strong>df -hl</strong></p>
  <pre><code>Filesystem            Size  Used Avail Use% Mounted on
  /dev/mapper/vg_os-lv_root
                        2.0G  1.3G  519M  72% /
  tmpfs                 3.9G     0  3.9G   0% /dev/shm
  /dev/sda1             239M  105M  122M  47% /boot
  /dev/mapper/vg_os-lv_tmp
                        976M   36M  889M   4% /tmp
  /dev/mapper/vg_os-lv_usr
                        9.8G  1.9G  7.4G  20% /usr
  /dev/mapper/vg_os-lv_var
                        5.8G  2.3G  3.3G  41% /var
  /dev/mapper/vg_os-lv_var_log
                        3.9G  3.8G     0 100% /var/log
  /dev/mapper/vg_data-lv_data
                         79G  9.7G   66G  13% /data
  </code></pre>
  <p><strong>ll /var/log</strong></p>
  <pre><code>total 799984
  -rw-------. 1 root root      4459 Apr 23  2014 anaconda.ifcfg.log
  -rw-------. 1 root root     31482 Apr 23  2014 anaconda.log
  -rw-------. 1 root root     42372 Apr 23  2014 anaconda.program.log
  
  ......
  
  -rw-------  1 root root       352 Jul 26  2016 yum.log-20170101
  -rw-------  1 root root       180 May 25  2017 yum.log-20180101
  </code></pre>
  <p>I've also tried
  <strong>du -h</strong>, seems also around 800M</p>
  <pre><code>4.0K    /var/log/newrelic-infra
  du: cannot read directory `/var/log/audit': Permission denied
  112K    /var/log/audit
  7.3M    /var/log/rhsm
  du: cannot read directory `/var/log/aws': Permission denied
  4.0K    /var/log/aws
  12K     /var/log/ConsoleKit
  6.7M    /var/log/sa
  du: cannot read directory `/var/log/sssd': Permission denied
  4.0K    /var/log/sssd
  20K     /var/log/vmware-imc
  du: cannot read directory `/var/log/httpd': Permission denied
  4.0K    /var/log/httpd
  du: cannot read directory `/var/log/samba': Permission denied
  4.0K    /var/log/samba
  4.0K    /var/log/ntpstats
  60K     /var/log/tuned
  du: cannot read directory `/var/log/lost+found': Permission denied
  16K     /var/log/lost+found
  8.0K    /var/log/prelink
  796M    /var/log
  </code></pre>
  <p>Why is that? How to solve this problem ?</p>
  <p>Thanks,</p>
  <p>Frank</p>