Where are the process crash logs kept? I'm wanting to delete or truncate old ones, and don't know where to find them. I've looked under /var/logs, but can't seem to determine which ones are for crashed processes. Thanks.
There are number of queries in your post which can't easily be answered with a single response.
The "logs" are generally kept in the /var/log directory. But "crash logs" is an ambiguous expression when considering what constitutes a crash.
If the kernel "crashes" and leaves a core dump, it's usually left in /var/lib/systemd/coredump, and needs specialised tools to analyse it. It's usually a developer's realm rather than a user's.
If a kernel panics, that is "crashes" before it can load up a system, it's messages are on the screen, and may or may not be left in a file depending on how things are configured. Usually such a crash (panic) hasn't got the system up, so it can't write its output to a file on the system, but it's possible to capture the kernel output on a serial connection if its configured and attached to the system.
In relation to deleting or truncating log files, you can find out which files are largest in just the /var/log directory with the command:
and for the disk usage of the whole /var/log directory and its subdirectories with (as root):
That may be a long list which may be useful depending on what you wish to know. In the example below, the screen output is more economical and may be enough to be informative.
In relation to truncating or deleting log files, it's possible to use configurations rather than brute force deletions as shown in the following example.
It's the directories in /var/log that tend to hold the most data, so the following output shows the size of the directory and its subdirectories on this machine:
Code:
[root@fen ~]# du -hxd1 /var/log
49M ./journal
64K ./wicd
20K ./lightdm
4.0K ./firebird
596K ./apt
16M ./installer
84K ./cups
8.0K ./hp
8.0K ./runit
4.0K ./private
8.0K ./sysstat
4.0K ./speech-dispatcher
48K ./exim4
79M .
The journal directory holds the most data (49M). It's controlled by a configuration in the file:
/etc/systemd/journald.conf.
On this machine the configuration: SystemMaxUse=50M, has been written into the journald.conf file to limit the journal size to 50M. If that limit is not set by the user, the journal can grow very large, even gigabytes.
Other configuration to limit log files are through configuring log rotation, as mentioned by dos2unix above.