[SOLVED] My expanded /var

Milo4t · 09-19-2019, 03:03 AM

Hi all.
I had this exact same problem about a year ago (see: "I need to increase the size of /var - adjacent to an NTFS partition"). In that problem my /var was only 6.8Gb in size. After I re-sized partitions (NTFS and /var) my /var was (and is) 14Gb in size. It too has completely filled up.
I discovered this problem this morning when I tried to install an update, it failed as /var was full.

The main culprits are 3 folders I have found so far:
/var/log - 3.9Gb
/var/lib/plexmediaserver - 3Gb (I expected this but I need to keep that)
/var/spool - 3.7Gb

So what is going on, /var is twice the size now. Why are /log and /spool so huge?????
I don't want to have to go through the rigmarole of re-sizing all the time, that seems ridiculous.
As always, any help greatly appreciated.

syg00 · 09-19-2019, 05:13 AM

Quote:

Originally Posted by Milo4t

Why are /log and /spool so huge?????

Only you can answer that - go have a look.
On one of our netbooks a wifi adapter generated millions of logs - gave GB size kernel and syslog. I just empty them - the compressed rotations are much more acceptable, but no point keeping them either. Short answer - fix the problem.

Milo4t · 09-20-2019, 08:23 PM

Thanks for that but of no help. I don't know how to do either of those things you specify - empty the logs or turn on compressed rotational logs. I had a look in the System Logs section of the MCC and couldn't find any way to achieve what you say.

I should say I am using Dolphin to do this, I'm not a CLI-type of guy.

Also in /var/spool/mail/ there is something called "root" that is 3.7Gb big. I can't see anything specific in /var/log taking up 3.9Gb, but there are some folders I can't access in Dolphin.

frankbell · 09-20-2019, 09:34 PM

Do you have logrotate installed? (I would expect it to be by default.) Years ago, I ran into a similar problem on Debian and installing logrotate made it go away. And, no, I don't know why it wasn't already present.

If you do, and /var/log is filling up with log files that logrotate has rotated (they generally end in a number, like [somelog].1, [somelog].2, etc.), perhaps you could write a script to run as a [unit-time] cron job to delete those files.

([unit-time] would be long enough to be reasonably certain that you won't need to consult those archived logs.)

Milo4t · 09-20-2019, 10:55 PM

Yes I do have logrotate installed (I just checked) and it seems to have been installed by default. And, yes, it seems to keep 5 logs, 1 current log and 4 previous. So there is something else in one of the other folders in /var/log (some I can't see into with my logon) under Dolphin.

So there's that and there's the /var/spool/mail/root problem.

syg00 · 09-21-2019, 12:27 AM

Run this from a terminal - if you don't have sudo, will need root.

Code:

sudo du -h /var | sort -hr | head -n 15

Milo4t · 09-22-2019, 05:16 AM

Result of the command. Sorry for the delay.

Code:

[myles@Bilbo ~]$ sudo du -h /var | sort -hr | head -n 15
[sudo] password for myles: 
13G     /var
4.4G    /var/log
3.9G    /var/spool/mail
3.9G    /var/spool
3.8G    /var/lib
3.3G    /var/lib/plexmediaserver
3.2G    /var/lib/plexmediaserver/Library/Application Support/Plex Media Server
3.2G    /var/lib/plexmediaserver/Library/Application Support
3.2G    /var/lib/plexmediaserver/Library
1.7G    /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Metadata
934M    /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Metadata/TV Shows
803M    /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Media/localhost
803M    /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Media
801M    /var/log/journal/badb2719d00f4b4697ade2f7fd49c6ba
801M    /var/log/journal
[myles@Bilbo ~]$

ondoho · 09-22-2019, 05:52 AM

You should move your media server out of /var; it will only grow and grow, I assume it contains the actual media files?

If you repeat the du command plus the '-x' option, is the output the same as above?

Code:

sudo du -xh /var | sort -hr | head -n 15

Milo4t · 09-22-2019, 07:49 PM

Yes the results are the same.
I don'think I can move PMS out of /var as that is where it gets installed. I have just asked though. And yes it holds all of the relevant PMS data as well as my media file data descriptions etc. My media files are actually located on an external NTFS drive.
But I am more interested in the contents of some folders within /var/log that I can't access and hold most of the space for that folder as the usual system logs only use about 800Mb. Also more interested in this: /var/spool/mail/root which is what is consuming the entire 3.9Gb of space.

ondoho · 09-23-2019, 02:24 AM

Quote:

Originally Posted by Milo4t

But I am more interested in the contents of some folders within /var/log that I can't access and hold most of the space for that folder as the usual system logs only use about 800Mb. Also more interested in this: /var/spool/mail/root which is what is consuming the entire 3.9Gb of space.

You need to get in there and see what it is.

And about the logs: there's probably a reason why there's too much of it. You need to get in there and see what it is.
Come to think of it, the root mail probably contains the same log messages.

And activate log rotation if it isn't already.

Milo4t · 09-25-2019, 09:10 PM

I've now freed up some space and can function again. Now I just need to keep an eye on the size of /var and mange it better.

thaks for the help.

ondoho · 09-26-2019, 01:28 AM

This isn't really SOLVED because you aren't telling us what you deleted, and you didn't get to the source of the problem either.

Somebody else having the same problem won't get much help from this thread.