Log files eating hard disk space

[tona_107]

(two parts)
Hi,
I'm running ubuntu 8.10 amd64 on my HP intel 2.26ghz dual core processor, 320gb hdd and 4gb ram.

My main problem is that when I dual booted ubuntu onto my laptop, I had vista already installed, so I only set aside 20GB of hard disk space for ubuntu, which seems like more than enough to me. What's going on is that it says I have used all my space and only have one GB left, when the only thing I have on my computer are word files and necessary installs like flash player, compiz, avant, etc.

When trying to hunt down what was using all my space, first I checked out the disk usage analyzer (some pics from here in):

theres my hdd with 1/19 gb remaining


here's a breakdown of my home folder, showing that it's not using very much at all



here's my filesystem, now we can see that all the space is being used in the folder: /var



looking closer now we see that it's all in /var/log



...cont'd

[tona_107]

...

and now we see that it's all being used by files inside the log folder



So I browsed my computer looking for this infamous log folder and it indeed was the one eating up all the space:



keep in mind that I am good with computers, but I'm no hacking specialist or anything like that, so I'm not very familiar with the intense inner runnings of computers, like, advanced dosprompt/terminal functions or the system folders. I don't know what the log files are, I'd just assume they are a log of the system activity for something or other, but I don't see why they take up 14 GB, anyone have any ideas what's going on and what I can do? I'll leave you finally with a picture of all the files inside the "/var/log".



thanks in advance.

[HROAdmin26]

Many processes may send their logs to /var. Most of the time when a log grows quickly it's due to some repetitive error being reported in the log over and over again.

You need to identify which log(s) is the problem.

cd /var/log

du -sh *

[tona_107]

Many processes may send their logs to /var. Most of the time when a log grows quickly it's due to some repetitive error being reported in the log over and over again.

You need to identify which log(s) is the problem.

cd /var/log

du -sh *

When I try that code this is what I get:

daniel@daniel-laptop:~$ cd /var/log
daniel@daniel-laptop:/var/log$ du -sh*
du: invalid option -- '*'
Try `du --help' for more information.
daniel@daniel-laptop:/var/log$ du -sh
du: cannot read directory `./samba/cores': Permission denied
14G .
daniel@daniel-laptop:/var/log$

Also, someone had asked me to do something similar on the Ubuntu forums, but I didn't know what to do from there... Here's a link to the thread, but I'll copy and paste it too.

[ubuntu] Lib/log files eating hard disk space. - Ubuntu Forums

That's interesting that the first set of rotated logs are huge, but you don't mention the live ones being too big. The live ones have no extension, the rotated ones get .0 then .1 etc appended.

Can you actually take a look inside one of those files?

If you open a terminal, and first of all type

less /var/log/kern.log

Ideally you will something logging vast quantities of information, and finding out what that something is (or was) is the first step towards fixing it.

I don't even have enough space to save a screenshot but this is what the terminal said when i typed it in:

Jan 28 11:07:52 daniel-laptop kernel: [ 2289.150343] wlan0: authenticate with AP 00:15:70:43:0d:ac
Jan 28 11:07:52 daniel-laptop kernel: [ 2289.155412] wlan0: authenticated
Jan 28 11:07:52 daniel-laptop kernel: [ 2289.155423] wlan0: associate with AP 00:15:70:43:0d:ac
Jan 28 11:07:52 daniel-laptop kernel: [ 2289.166380] wlan0: RX ReassocResp from 00:15:70:43:0d:ac (capab=0x401 status=0 aid=5)
Jan 28 11:07:52 daniel-laptop kernel: [ 2289.166390] wlan0: associated
Jan 28 11:19:52 daniel-laptop kernel: [ 3009.238943] wlan0: authenticate with AP 00:a0:f8:e9:3f:44
Jan 28 11:19:52 daniel-laptop kernel: [ 3009.240321] wlan0: authenticate with AP 00:a0:f8:e9:3f:44
Jan 28 11:19:53 daniel-laptop kernel: [ 3009.440166] wlan0: authenticate with AP 00:a0:f8:e9:3f:44
Jan 28 11:19:53 daniel-laptop kernel: [ 3009.640585] wlan0: authenticate with AP 00:a0:f8:e9:3f:44
Jan 28 11:19:53 daniel-laptop kernel: [ 3009.840124] wlan0: authentication with AP 00:a0:f8:e9:3f:44 timed out
Jan 28 11:20:04 daniel-laptop kernel: [ 3020.945449] wlan0: authenticate with AP 00:a0:f8:e9:3f:44
Jan 28 11:20:04 daniel-laptop kernel: [ 3020.945936] wlan0: authenticate with AP 00:a0:f8:e9:3f:44
Jan 28 11:20:04 daniel-laptop kernel: [ 3021.144125] wlan0: authenticate with AP 00:a0:f8:e9:3f:44
Jan 28 11:20:05 daniel-laptop kernel: [ 3021.344067] wlan0: authenticate with AP 00:a0:f8:e9:3f:44

i don't know what this means, but thanks again for all the help.

[oz]

daniel@daniel-laptop:/var/log$ du -sh*
du: invalid option -- '*'

Welcome to the forums!

You need to include the space between the -sh and the * in your command:

du -sh *

[tona_107]

Welcome to the forums!

You need to include the space between the -sh and the * in your command:

du -sh *

thanks a bunch, you guys are really helpful.
this is what came up (am I right to say that this is just a breakdown of the size of all the files in /var/log? if so, then in the link I provided I tracked down the same results, namely that these files, kern.log.0 (4.7GB), syslog.0 (4.6GB), messages.0 (4.3GB), were huge):

daniel@daniel-laptop:~$ cd /var/log
daniel@daniel-laptop:/var/log$ du -sh *
4.0K apparmor
384K apt
4.0K aptitude
20K auth.log
12K auth.log.0
4.0K auth.log.1.gz
8.0K auth.log.2.gz
4.0K auth.log.3.gz
4.0K boot
36K bootstrap.log
4.0K btmp
112K ConsoleKit
52K cups
144K daemon.log
156K daemon.log.0
28K daemon.log.1.gz
40K daemon.log.2.gz
8.0K daemon.log.3.gz
68K debug
9.5M debug.0
16K debug.1.gz
216K debug.2.gz
40K debug.3.gz
8.0K debug.4.gz
4.0K dist-upgrade
4.0K dkms_autoinstaller
44K dmesg
48K dmesg.0
12K dmesg.1.gz
12K dmesg.2.gz
12K dmesg.3.gz
12K dmesg.4.gz
1.2M dpkg.log
8.0K faillog
4.0K fontconfig.log
12K fsck
28K gdm
712K installer
252K kern.log
4.7G kern.log.0
68K kern.log.1.gz
113M kern.log.2.gz
64K kern.log.3.gz
220K kern.log.4.gz
40K lastlog
0 lpr.log
212K mail.err
260K mail.err.0
12K mail.err.1.gz
4.0K mail.err.2.gz
512K mail.info
700K mail.info.0
28K mail.info.1.gz
4.0K mail.info.2.gz
512K mail.log
700K mail.log.0
28K mail.log.1.gz
4.0K mail.log.2.gz
212K mail.warn
260K mail.warn.0
12K mail.warn.1.gz
4.0K mail.warn.2.gz
200K messages
4.4G messages.0
56K messages.1.gz
103M messages.2.gz
48K messages.3.gz
180K messages.4.gz
4.0K news
4.0K pm-suspend.log
0 pycentral.log
du: cannot read directory `samba/cores': Permission denied
24K samba
480K syslog
4.7G syslog.0
56K syslog.2.gz
60K syslog.3.gz
68K syslog.4.gz
113M syslog.5.gz
120K syslog.6.gz
400K udev
4.0K unattended-upgrades
8.0K user.log
4.0K user.log.0
4.0K user.log.1.gz
4.0K user.log.2.gz
4.0K user.log.3.gz
4.0K wpa_supplicant.log
4.0K wpa_supplicant.log.1.gz
4.0K wpa_supplicant.log.2.gz
4.0K wpa_supplicant.log.3.gz
4.0K wpa_supplicant.log.4.gz
4.0K wpa_supplicant.log.5.gz
188K wtmp
4.0K wvdialconf.log
16K Xorg.0.log
16K Xorg.0.log.old



If you could, you should check out my last post too and take a look at the code that I pasted there.
It seemed like it was authenticating with "AP on wlan0" an awful lot (although I don't know what it means...sounds like something to do with my internet/wireless?).
Alas, you guys are the experts not me, I'm just trying to learn.

Thanks in advance for any help.

[HROAdmin26]

Run:

cd /var/log

sudo gzip kern.log.0 syslog.0 messages.0

[tona_107]

Run:

cd /var/log

sudo gzip kern.log.0 syslog.0 messages.0

I just ran that, is that going to zip those logs?

Will that fix the problem, or will it still keep on making a crazy amount of logs?

[tona_107]

I just ran that, is that going to zip those logs?

Will that fix the problem, or will it still keep on making a crazy amount of logs?

wow.

that freed up 13.8GB...
am I going to continue having to zip them like that? It seems like something that should be happening automatically.

thanks everyone so far.

[HROAdmin26]

Logs don't generally blow up that large without reason. Please read my first post again.

Many processes may send their logs to /var. Most of the time when a log grows quickly it's due to some repetitive error being reported in the log over and over again.