Scenario

The /var/log/messages file has been growing unusually fast, filling up disk space within hours.

Task

Identify the process that is writing heavily to /var/log/messages by monitoring system activity in real time. Save the process details using ps and last 50 lines of logs at /home/devops/excessive_log_process.txt

Example

# Before (log file growing rapidly)

/var/log/messages: 15 GB and increasing
Disk usage: 92% and climbing

# After (responsible process identified)

Process identified: rsyslogd (PID 1234)
Confirmed active writes to /var/log/messages

Step 1: Monitor new log entries in real-time to see what's being written.

tail -f /var/log/messages

Observe the output and identify which process name and PID appears most frequently. Press Ctrl+C to stop monitoring once you've identified the pattern.

Step 2: Get detailed information about the identified process using its PID.

ps -p <PID> -f

Step 3: Save the process details to the output file.

ps -p <PID> -f > /home/devops/excessive_log_process.txt

Step 4: Append sample log entries from that process to provide evidence.

tail -50 /var/log/messages | grep "<processname>" >> /home/devops/excessive_log_process.txt