Var Log using up all my HD
 

I am using an older Dell laptop with only 26GB HD and running Ubuntu 11.04
I am getting messages telling me my HD is running out of room. As I explored this, I found that the log under var is using 20.1GB and growing a bit each time I turn on the computer. Can I safely delete the files in this log?
Thanks for any help you can give me.
Mike

What is the log file name?

Traditionally the /var/ directory is set as a separate file system to prevent the hard drive from filling up and causing issues so if it does fill up it only affects that file system. /var/ is used mostly for storing log files of which they can usually be removed. However, the info inside may be of use depending upon the app that is logging it. Most apps will have a config file that you tell it what to log, for instance Apache HTTP web server has different levels you can set to log from warn to error, which one you select will tell Apache how much info to log and most apps have a similar directive you can modify to prevent this from re-occurring.

Are you running Dell OpenManage (omsa) on the server? If so are the logs you talking about TTY_*?

Have a look at this thread:
http://lists.us.dell.com/pipermail/l...er/037452.html

The main logs in /var/log are those used by the system (with /var/log/messages being the main one). You can not simply delete logs usually because they are in active use by a process. When you delete an open file it deletes only the name but NOT the inode so doesn't free up space until the process goes away.

Instead log rotation routines such as that described in the above link should be used. By default RHEL5 does log rotation for several of the logs (including messages) in /var/log so you shouldn't need to delete things. It may be someone has adjusted your rotation or that you are getting so many messages that standard rotation doesn't suffice. In which case you might want to investigate WHAT is in the logs rather than how large they are. Perhaps you have something too verbose turned on? Something logging to this log that ought to log elsewhere? Some issue that you can fix to stop dozens of log messages? It doesn't help you to clear the size of the log if the real problem is something like the log being full of messages telling you / is full and you're not addressing that underlying issue.

If you don't care for what's in these logs, yes you can delete the logs, but your problem will remain and make you do it over and over again after some time. I'd start with finding the log file which grows so fast.

you'll see either a big file or several small (100MB) but with a common name. Examine them and see what is the problem. The file without dot number at the end is most recent and you should be able to see the cause by



______________________________________

Please also make sure you don't have an empty CD in your CD-ROM. I had this problem recently, what I've done was:

1. removed an empty CD from the drive
2. deleted old logs
   Code:

   ---

   rm -rf /var/log/syslog.*

   ---

3. removed unnecessary lines from the most recent syslog file with
   Code:

   ---

   sed -i "/Make sure there is a disc in the drive./d" /var/log/syslog

   ---

Doing an rm -rf to your log directory is not advised in most cases. Alot of times you will see issues with processes, esp syslog and other logging processes, removing and/or rotating log files but the process never kills so the inodes do not get removed/updated properly. This can cause your df -h to show 100% usage but du -sh will show much less. If this is the case you simply need to find the process that has the log file open:

Then you can kill the process or restart the associated daemon and the inodes should get removed properly and your disk usage be read correctly. This happened to me recently with VNC server and its logging.

Right! Two remarks:
- it's a laptop, which I assume is restarted pretty often
- rm -rf /var/log/syslog.* will remove old rotated logs only, not the one syslog is writing to...

Also, have a look at the logrotate settings. If logrotate is not set up as a cron job, it should be.

http://www.thegeekstuff.com/2010/07/logrotate-examples/

Thankyou for all the responses; however, I have been unable to solve the problem. I am not very literate in Linux code and was unable to get any response by pasting the suggestions into the terminal command box. What I will do at the completion of this message is to "nuke" the HD and reload Ubuntu. The only information I keep on the HD is the bookmarks in Firefox, which I can save and reload. I suspect that this problem will occur again in the future, but perhaps by then I can figure out how to cure or prevent it. It all seems to be tied into the "log" file in "Var", which just keeps growing. There are several files that seem to duplicate with extensions numbering 1 and upward to 10 or more. Example: Alternatives.log.5 gz and dmesg.1.gz. Although these are not large files, they keep growing in number.
Thanks again for your responses. Catch you on the "other side".
Mike