On Thu, May 13, 2021 at 12:58 AM Walter Dnes <waltdnes@waltdnes.org> wrote:
>
<SNIP>
> # no packages own wtmp and btmp -- we'll rotate them here.
> /var/log/wtmp {
> monthly
> create 0664 root utmp
> minsize 1M
> rotate 1
> }
> /var/log/btmp {
> missingok
> monthly
> create 0600 root utmp
> rotate 1
> }
<SNIP>

As you reported 'roughly monthly' failures my guess would be the above two sections

> And maybe either stop logging Facebook, or else log iptables messages
> to a separate file (how is that done?). The Facebook tracker messages
> are generated by iptables rules...

Don't log what you're not interested in. If your disk is getting filled up with billions of Facebook issues then limit how much of that you track.

HTH,

Mark