> If you look in /etc/newsyslog.conf, /var/log/messages gets trimmed once it
> reaches a certain size. By default, this is 30K. 
and started once per hour.
still not a solution - you may end with logfiles with 1/1000 of real data
(which you want to read) and 999/1000 of abuser noise. not nice.