|
You may want to keep an eye on that massive syslog in particular - that should clean itself up any day now. If it doesn't, it may be a good idea to install an application that will see to it.
|
Will do.
First thing I did this evening when booting up was run the du /var/log command. /var/log = 2221948 /var/log/syslog = 2216872 I don't believe I had any kern log or messages log at that time. After doing some email and browsing, installed a new program, read your post, and checked the logs again. var/log = 3798952 var/log/kern.log = 1219452 var/log/syslog = 1219348 var/log/messages = 1217280 var/log/syslog.1.gz = 137868 So I can see my total log is growing. I have no idea why I have two different syslog's now. The two combined are larger than the one single I had earlier this evening. Thanks |
The ".gz" is a compressed backup. It'll get cleaned up automagically.
With all 3 logs being similar size like that, you've got another problem developing. Have a look at those logs as I suggested earlier. |
Well, there aren't two, really. The second one has a .gz extension. This means it is your original syslog but it has been compressed to save space. Any new messages will be written to the new syslog. This is routine stuff; syslogs get split up and compressed from time to time - the underlying idea is that no-one is interested in keeping logs forever. When this happens, the system uses the new instance of the syslog to record its messages; the .gz is only a back-up and can be removed. I recommend that you delete the .gz file by hand for now. If your syslog keeps growing at this rate and you keep getting such massive .gz files, it may be worthwhile setting up a cron job - it will automatically check for such files and delete them. Far more convenient than doing it manually over and over again.
I'm wondering about the size of your new syslog, though. It seems to have grown a lot again. Do you see any recurring messages/warnings when you inspect it? This should lead you to an explanation of what is going wrong (although you may find it hard to find out what they mean exactly). If all you did was read mail and surf the internet, the problem would seem to be network-related. |
I did follow your suggestion.
Trouble is I have a hard time reading/understanding what the reply to the command means. I will go look through the logs again. Thanks |
If you post a small piece of the file we may be able to help you troubleshoot it. Run the command
Code:
tail -100 /var/log/messagesAlso, post your /etc/syslog.conf file contents. |
here are some messages log
Jun 6 20:00:31 mike-desktop kernel: [ 53.656820] ACPI: Power Button (FF) [PWRF] Jun 6 20:00:31 mike-desktop kernel: [ 53.685781] input: Power Button (CM) as /class/input/input5 Jun 6 20:00:31 mike-desktop kernel: [ 53.690192] ACPI: Power Button (CM) [VBTN] Jun 6 20:00:31 mike-desktop kernel: [ 53.723967] Using specific hotkey driver Jun 6 20:00:31 mike-desktop kernel: [ 53.773407] pcc_acpi: loading... Jun 6 20:00:34 mike-desktop dhcdbd: Started up. Jun 6 20:00:35 mike-desktop dhcdbd: message_handler: message handler not found under /com/redhat/dhcp/eth0 for sub-path eth0.dbus.get.reason Jun 6 20:00:35 mike-desktop dhcdbd: message_handler: message handler not found under /com/redhat/dhcp/eth0 for sub-path eth0.dbus.get.reason Jun 6 20:00:35 mike-desktop kernel: [ 58.579191] ppdev: user-space parallel port driver Jun 6 20:00:35 mike-desktop kernel: [ 58.598189] [drm] Initialized drm 1.1.0 20060810 Jun 6 20:00:35 mike-desktop kernel: [ 58.618291] ACPI: PCI Interrupt 0000:00:02.0[A] -> GSI 16 (level, low) -> IRQ 17 Jun 6 20:00:35 mike-desktop kernel: [ 58.618773] [drm] Initialized i915 1.6.0 20060119 on minor 0 Jun 6 20:00:36 mike-desktop hpiod: 1.7.3 accepting connections at 2208... Jun 6 20:00:37 mike-desktop dhcdbd: message_handler: message handler not found under /com/redhat/dhcp/eth0 for sub-path eth0.dbus.get.host_name Jun 6 20:00:37 mike-desktop dhcdbd: message_handler: message handler not found under /com/redhat/dhcp/eth0 for sub-path eth0.dbus.get.nis_domain Jun 6 20:00:37 mike-desktop dhcdbd: message_handler: message handler not found under /com/redhat/dhcp/eth0 for sub-path eth0.dbus.get.nis_servers Jun 6 20:00:39 mike-desktop kernel: [ 62.574692] apm: BIOS version 1.2 Flags 0x03 (Driver version 1.16ac) Jun 6 20:00:39 mike-desktop kernel: [ 62.574697] apm: overridden by ACPI. Jun 6 20:20:30 mike-desktop -- MARK -- Jun 6 20:35:11 mike-desktop gconfd (mike-5743): starting (version 2.18.0.1), pid 5743 user 'mike' Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/etc/gconf/gconf.xml.mandatory" to a read-only configuration source at position 0 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readwrite:/home/mike/.gconf" to a writable configuration source at position 1 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only configuration source at position 2 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readwrite:/home/mike/.gconf" to a writable configuration source at position 3 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only configuration source at position 4 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/var/lib/gconf/debian.defaults" to a read-only configuration source at position 5 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/var/lib/gconf/defaults" to a read-only configuration source at position 6 Jun 6 20:35:15 mike-desktop gconfd (mike-5743): Resolved address "xml:readwrite:/home/mike/.gconf" to a writable configuration source at position 0 Jun 6 20:48:18 mike-desktop kernel: [ 2917.487095] usb 5-2: new high speed USB device using ehci_hcd and address 2 Jun 6 20:48:18 mike-desktop kernel: [ 2917.705380] usb 5-2: configuration #1 chosen from 1 choice Jun 6 20:48:18 mike-desktop kernel: [ 2917.825391] usbcore: registered new interface driver libusual Jun 6 20:48:18 mike-desktop kernel: [ 2917.833929] Initializing USB Mass Storage driver... Jun 6 20:48:18 mike-desktop kernel: [ 2917.834031] scsi0 : SCSI emulation for USB Mass Storage devices Jun 6 20:48:18 mike-desktop kernel: [ 2917.834085] usbcore: registered new interface driver usb-storage Jun 6 20:48:18 mike-desktop kernel: [ 2917.834089] USB Mass Storage support registered. Jun 6 20:48:23 mike-desktop kernel: [ 2922.861700] scsi 0:0:0:0: Direct-Access ST325082 4A 3.AA PQ: 0 ANSI: 0 Jun 6 20:48:23 mike-desktop kernel: [ 2922.890243] SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB) Jun 6 20:48:23 mike-desktop kernel: [ 2922.891362] sda: Write Protect is off Jun 6 20:48:23 mike-desktop kernel: [ 2922.893231] SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB) Jun 6 20:48:23 mike-desktop kernel: [ 2922.894230] sda: Write Protect is off Jun 6 20:48:23 mike-desktop kernel: [ 2922.894595] sda: sda1 Jun 6 20:48:23 mike-desktop kernel: [ 2922.918949] sd 0:0:0:0: Attached scsi disk sda Jun 6 20:48:23 mike-desktop kernel: [ 2922.929076] sd 0:0:0:0: Attached scsi generic sg0 type 0 Jun 6 21:00:30 mike-desktop -- MARK -- and some syslog Jun 6 20:00:38 mike-desktop NetworkManager: <WARNING>^I nm_spawn_process (): nm_spawn_process('/usr/sbin/nscd -i hosts'): could not spawn process. (Failed to execute child process "/usr/sbin/nscd" (No such file or directory)) Jun 6 20:00:38 mike-desktop NetworkManager: <information>^IActivation (eth0) successful, device activated. Jun 6 20:00:38 mike-desktop NetworkManager: <information>^IActivation (eth0) Finish handler scheduled. Jun 6 20:00:38 mike-desktop NetworkManager: <information>^IActivation (eth0) Stage 5 of 5 (IP Configure Commit) complete. Jun 6 20:00:39 mike-desktop /etc/mysql/debian-start[5420]: Upgrading MySQL tables if necessary. Jun 6 20:00:39 mike-desktop avahi-daemon[5046]: Registering new address record for fe80::20c:f1ff:fe9c:8895 on eth0.*. Jun 6 20:00:39 mike-desktop kernel: [ 62.574692] apm: BIOS version 1.2 Flags 0x03 (Driver version 1.16ac) Jun 6 20:00:39 mike-desktop kernel: [ 62.574697] apm: overridden by ACPI. Jun 6 20:00:40 mike-desktop anacron[5545]: Anacron 2.3 started on 2007-06-06 Jun 6 20:00:40 mike-desktop anacron[5545]: Normal exit (0 jobs run) Jun 6 20:00:40 mike-desktop /etc/mysql/debian-start[5559]: Checking for crashed MySQL tables. Jun 6 20:00:40 mike-desktop /usr/sbin/cron[5574]: (CRON) INFO (pidfile fd = 3) Jun 6 20:00:40 mike-desktop /usr/sbin/cron[5577]: (CRON) STARTUP (fork ok) Jun 6 20:00:40 mike-desktop /usr/sbin/cron[5577]: (CRON) INFO (Running @reboot jobs) Jun 6 20:00:48 mike-desktop kernel: [ 71.421279] eth0: no IPv6 routers present Jun 6 20:00:49 mike-desktop ntpdate[5690]: step time server 82.211.81.145 offset -1.290530 sec Jun 6 20:17:01 mike-desktop /USR/SBIN/CRON[5695]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Jun 6 20:35:11 mike-desktop gconfd (mike-5743): starting (version 2.18.0.1), pid 5743 user 'mike' Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/etc/gconf/gconf.xml.mandatory" to a read-only configuration source at position 0 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readwrite:/home/mike/.gconf" to a writable configuration source at position 1 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only configuration source at position 2 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readwrite:/home/mike/.gconf" to a writable configuration source at position 3 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only configuration source at position 4 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/var/lib/gconf/debian.defaults" to a read-only configuration source at position 5 Jun 6 20:35:11 mike-desktop gconfd (mike-5743): Resolved address "xml:readonly:/var/lib/gconf/defaults" to a read-only configuration source at position 6 Jun 6 20:35:15 mike-desktop gconfd (mike-5743): Resolved address "xml:readwrite:/home/mike/.gconf" to a writable configuration source at position 0 Jun 6 20:35:18 mike-desktop NetworkManager: <information>^IUpdating allowed wireless network lists. Jun 6 20:35:18 mike-desktop NetworkManager: <WARNING>^I nm_dbus_get_networks_cb (): error received: org.freedesktop.NetworkManagerInfo.NoNetworks - There are no wireless networks stored.. Jun 6 20:48:18 mike-desktop kernel: [ 2917.487095] usb 5-2: new high speed USB device using ehci_hcd and address 2 Jun 6 20:48:18 mike-desktop kernel: [ 2917.705380] usb 5-2: configuration #1 chosen from 1 choice Jun 6 20:48:18 mike-desktop NetworkManager: <debug info>^I[1181184498.406901] nm_hal_device_added (): New device added (hal udi is '/org/freedesktop/Hal/devices/usb_device_136b_cb07_0006C0'). Jun 6 20:48:18 mike-desktop kernel: [ 2917.825391] usbcore: registered new interface driver libusual Jun 6 20:48:18 mike-desktop kernel: [ 2917.833929] Initializing USB Mass Storage driver... Jun 6 20:48:18 mike-desktop kernel: [ 2917.834031] scsi0 : SCSI emulation for USB Mass Storage devices Jun 6 20:48:18 mike-desktop kernel: [ 2917.834085] usbcore: registered new interface driver usb-storage Jun 6 20:48:18 mike-desktop kernel: [ 2917.834089] USB Mass Storage support registered. Jun 6 20:48:18 mike-desktop kernel: [ 2917.834221] usb-storage: device found at 2 Jun 6 20:48:18 mike-desktop kernel: [ 2917.834223] usb-storage: waiting for device to settle before scanning Jun 6 20:48:18 mike-desktop NetworkManager: <debug info>^I[1181184498.505236] nm_hal_device_added (): New device added (hal udi is '/org/freedesktop/Hal/devices/usb_device_136b_cb07_0006C0_if0'). Jun 6 20:48:18 mike-desktop NetworkManager: <debug info>^I[1181184498.507440] nm_hal_device_added (): New device added (hal udi is '/org/freedesktop/Hal/devices/usb_device_136b_cb07_0006C0_if0_scsi_host'). Jun 6 20:48:18 mike-desktop NetworkManager: <debug info>^I[1181184498.552078] nm_hal_device_added (): New device added (hal udi is '/org/freedesktop/Hal/devices/usb_device_136b_cb07_0006C0_usbraw'). Jun 6 20:48:23 mike-desktop kernel: [ 2922.826379] usb-storage: device scan complete Jun 6 20:48:23 mike-desktop kernel: [ 2922.861700] scsi 0:0:0:0: Direct-Access ST325082 4A 3.AA PQ: 0 ANSI: 0 Jun 6 20:48:23 mike-desktop kernel: [ 2922.890243] SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB) Jun 6 20:48:23 mike-desktop kernel: [ 2922.891362] sda: Write Protect is off Jun 6 20:48:23 mike-desktop kernel: [ 2922.891366] sda: Mode Sense: 03 00 00 00 Jun 6 20:48:23 mike-desktop kernel: [ 2922.891369] sda: assuming drive cache: write through Jun 6 20:48:23 mike-desktop kernel: [ 2922.893231] SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB) Jun 6 20:48:23 mike-desktop kernel: [ 2922.894230] sda: Write Protect is off Jun 6 20:48:23 mike-desktop kernel: [ 2922.894234] sda: Mode Sense: 03 00 00 00 Jun 6 20:48:23 mike-desktop kernel: [ 2922.894236] sda: assuming drive cache: write through Jun 6 20:48:23 mike-desktop kernel: [ 2922.894595] sda: sda1 Jun 6 20:48:23 mike-desktop kernel: [ 2922.918949] sd 0:0:0:0: Attached scsi disk sda Jun 6 20:48:23 mike-desktop kernel: [ 2922.929076] sd 0:0:0:0: Attached scsi generic sg0 type 0 mike@mike-desktop:~$ sudo /etc/syslog.conf Password: sudo: /etc/syslog.conf: command not found Thanks for slogging through this with me. |
Nothing really useful in there as far as I can see. I think you need to scroll down those logs and look for messages that keep recurring, especially such as signal a warningor an error.
|
Yeah, I'm not seeing anything either. Was that just after a reboot? If so, wait a little bit after you reboot to capture some output and try again.
Also, it is "cat /etc/syslog.conf" |
here is syslog.config
mike@mike-desktop:~$ cat /etc/syslog.conf # /etc/syslog.conf Configuration file for syslogd. # # For more information see syslog.conf(5) # manpage. # # First some standard logfiles. Log by facility. # auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log user.* -/var/log/user.log uucp.* /var/log/uucp.log # # Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err /var/log/mail.err # Logging for INN news system # news.crit /var/log/news/news.crit news.err /var/log/news/news.err news.notice -/var/log/news/news.notice # # Some `catch-all' logfiles. # *.=debug;\ auth,authpriv.none;\ news.none;mail.none -/var/log/debug *.=info;*.=notice;*.=warn;\ auth,authpriv.none;\ cron,daemon.none;\ mail,news.none -/var/log/messages # # Emergencies are sent to everybody logged in. # *.emerg * # # I like to have messages displayed on the console, but only on a virtual # console I usually leave idle. # #daemon,mail.*;\ # news.=crit;news.=err;news.=notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warn /dev/tty8 # The named pipe /dev/xconsole is for the `xconsole' utility. To use it, # you must invoke `xconsole' with the `-file' option: # # $ xconsole -file /dev/xconsole [...] # # NOTE: adjust the list below, or you'll go crazy if you have a reasonably # busy site.. # daemon.*;mail.*;\ news.crit;news.err;news.notice;\ *.=debug;*.=info;\ *.=notice;*.=warn |/dev/xconsole I found this command while googling for help with this problem. Supposed to show activity as it happens in the logs? mike@mike-desktop:~$ tail -f /var/log/syslog Jun 7 15:26:36 mike-desktop syslogd 1.4.1#20ubuntu4: restart. Jun 7 15:26:36 mike-desktop anacron[5514]: Job `cron.daily' terminated Jun 7 15:26:36 mike-desktop anacron[5514]: Normal exit (1 job run) mike@mike-desktop:~$ tail -f /var/log/messages Jun 7 15:26:36 mike-desktop syslogd 1.4.1#20ubuntu4: restart. This is the latest log totals. mike@mike-desktop:~$ du /var/log -a|sort -nr|head 3799412 /var/log 1219592 /var/log/kern.log.0 1219544 /var/log/syslog.0 1217416 /var/log/messages.0 137868 /var/log/syslog.2.gz 1180 /var/log/installer 972 /var/log/mysql 724 /var/log/dpkg.log.1 704 /var/log/installer/partman 568 /var/log/mysql/mysql-bin.000002 It doesn't seem to have grown as much or as quickly. I can safely delete the kern , messages, and syslog gz? Wondering if I cleaned it up a bit, it may be easier to see when the logs happen. Thanks again. |
You can remove the *.0, *.1, and the syslog.2.gz if you want. Those are the old logs that were growing out of bounds. The new logs don't even seem to be in your top 10 list, so it appears whatever was causing you the problem has gone away.
|
| All times are GMT -5. The time now is 12:55 AM. |