[SOLVED] Log files gigabytes in size. what is a standard procedure?

[reedb]

Hello,

How do you deal with log files that increase in file size?

For example, due to growth of log files, I ran out of disk space on my root file system. I only realized this after trying to update the system and received this error, E: You don't have enough free space in /var/cache/apt/archives/.

Some exerts from df and ls are shown below,

  $ df -H

Filesystem      Size  Used Avail Use% Mounted on

/dev/sdb2       196G  186G  5.3M 100% /

$ ls -lah

-rw-r-----   1 syslog   adm             4.5G Nov 30 21:51 syslog

-rw-r-----   1 syslog   adm             8.6G Nov 30 00:07 syslog.1

-rw-r-----   1 syslog   adm             174M Nov 29 00:10 syslog.2.gz

-rw-r-----   1 syslog   adm             240M Nov 28 00:06 syslog.3.gz

-rw-r-----   1 syslog   adm             357M Nov 27 00:08 syslog.4.gz

-rw-r-----   1 syslog   adm              60M Nov 26 00:07 syslog.5.gz

-rw-r-----   1 syslog   adm             315M Nov 25 00:10 syslog.6.gz

-rw-r-----   1 syslog   adm             707M Nov 24 00:09 syslog.7.gz

-rw-r-----   1 syslog   adm              32G Nov 30 21:51 ufw.log

-rw-r-----   1 syslog   adm              37G Nov 25 00:16 ufw.log.1

-rw-r-----   1 syslog   adm             841M Nov 18 00:20 ufw.log.2.gz

-rw-r-----   1 syslog   adm             1.8G Nov 11 00:06 ufw.log.3.gz

What do you suggest is a good way to handle log files? Is deleting okay? Or, is there another way to remove these files?

Thank you.

[Snowhog]

/var/cache/apt/archives/ doesn't contain 'log file'; it contains downloaded .deb packages (from apt). The easiest way to prevent what happened, is to clear the package cache on a periodic schedule. Personally, I do so after every apt package update.

See https://askubuntu.com/questions/3219...ched-deb-files

[claydoh]

/var/cache/apt/archives/ doesn't contain 'log file'; it contains downloaded .deb packages (from apt). The easiest way to prevent what happened, is to clear the package cache on a periodic schedule. Personally, I do so after every apt package update.

See https://askubuntu.com/questions/3219...ched-deb-files

look at the size of those log files again. The out of space message means the entire disk is full, not the package cache.

What we need to do is look at the log files and see what sort of messages are filling them up.

tail -f /path/thefile.log

You could try opening them in kate, or try ksyslog, but with files this size, kate will probably choke. Ksyslog might or might not, depending on how much of the log files it loads at once.

The firewall (ufw) log files are taking 79 Gb, so that is what I would investigate first.
It is safe to delete or move any of the log files ending with a number, those are older ones. Actually, they all can be deleted, really, but you do want to look into the giant ones before doing so.


the syslog is also rather big, the rest are probably ok size-wise. The ufw log is the big thing to check out, rule out anything bad happening, or if ufw is just spamming the log. Which may be configurable in its configs

[chimak111]

If you use the command-line and use apt instead of apt-get, no debs will be saved in /var/cache/apt/archives if the installation of the package(s) is successful. That is the default. A user can dig in and change the default.

I can't remember what package managers such as Muon, Synaptic, and Discover do. Though, IIRC, there's a post or two somewhere here on that.

But back to logs:

/var/log $ ls -lh -S
total 11M
-rw-rw-r--  1 root   utmp             18M Oct 22 06:25 lastlog
-rw-------  1 root   root            4.0M Aug 18 21:36 tallylog
-rw-------  1 root   root            3.1M Dec  2 06:41 boot.log
-rw-r--r--  1 root   root            2.0M Aug 18 21:36 faillog
-rw-r-----  1 syslog adm             1.4M Nov 25 07:06 kern.log.1
-rw-r-----  1 syslog adm             1.4M Dec  2 06:42 kern.log
-rw-r-----  1 syslog adm             1.2M Dec  2 06:46 syslog.1
-rw-r--r--  1 root   root            630K Dec  2 06:41 uvcdynctrl-udev.log
-rw-r-----  1 syslog adm             368K Nov 19 06:05 kern.log.2.gz
-rw-rw-r--  1 root   utmp            335K Dec  1 06:21 wtmp.1
-rw-r-----  1 syslog adm             319K Nov  5 05:29 kern.log.4.gz
-rw-r-----  1 syslog adm             257K Nov 11 06:23 kern.log.3.gz
-rw-r--r--  1 root   root            251K Nov 30 18:12 dpkg.log.1
-rw-r--r--  1 root   root            149K May 31  2018 dpkg.log.7.gz
-rw-r-----  1 syslog adm              97K Nov 30 06:25 syslog.3.gz
-rw-r-----  1 syslog adm              91K Dec  1 06:24 syslog.2.gz
-rw-r-----  1 syslog adm              90K Dec  2 07:30 auth.log
-rw-r-----  1 syslog adm              89K Nov 28 06:11 syslog.5.gz
-rw-r-----  1 syslog adm              88K Nov 29 06:26 syslog.4.gz
-rw-r-----  1 syslog adm              87K Nov 27 05:57 syslog.6.gz

So there's something writing to your logs that is causing the bloat.

You'll need to somehow inspect the bloated logs and figure the reason.

[reedb]

You all have provided much needed information. I'll be busy looking into your responses. And, learning more about this.

Thank you all for your help!