I am running Xubuntu 16.04LTS on a 64 bit computer. I have a hard drive of 70GB that is regularly just about half full. A couple of months ago, I got warnings that I couldn't save anything because my hard drive was completely full. I checked Disk Usage Analyzer and it said the hard drive was indeed completely full. I saw that "Upstart" was the offender. But the next day (I did nothing--but panic) "Upstart" was gone, and the hard drive was back to half full.

Today again the warnings about not being able to save etc came. I checked the Disk Usage Analyzer (screenshot 66) and again "Upstart" was the culprit. So I went to the File Manager (screenshot 67) and a log from just today was 40.3GB. I saw that the log was a plain text document so I tried to open it with Mousepad but it just ran for ten minutes and so I eventually stopped both Mousepad and .cache in the Task Manager.

Well, the computer did have a lot on it at one point today: GIMP, Libre Office Writer, Firefox. But I had shut GIMP down and everything was working properly for a while, but then, as I said, I started getting the warnings that it wouldn't save and other functionality (eg. browser tabs would crash) was affected, as well.

I shut down the computer and then started it back up. That did nothing.

I did and then . Then I checked Disk Usage Analzyer and it said that all 70 GB were still being used, and checking via the terminal indicated the same thing. But after a couple of minutes when I ran the visual diagram from Disk Usage Analyzer I got screenshot 69, saying basically "Upstart" was gone. I also checked the .cache/Upstart and the 40.3GB log was indeed gone.

Oddly, though, the terminal still showed that the hard drive was full, as did the initial look (the bar graphs) of Disk Usage Analyzer. But eventually both of those things also indicated that the 40.3GB was gone.

As far as I could tell the sudo apt-get update and sudo apt-get upgrade got rid of the log, but that may have been coincidental.

Questions:
1) Any guess as to why this is happening?
2) Any suggestions on how to stop it from happening again?
3) If it does happen again, any suggestions on how to get the hard drive space back?
4) Especially since the 40.3 GB log got removed (I didn't do it) from the .cache somehow, if this should happen again, would it be okay to just delete that 40.3GB (startxfce4.log.1) log? (.ie deleting it won't screw anything else up)

Thank you!

Attached Thumbnails

     

It was co-incidental. Log rotation is compressing it and resetting the file - logs compress well.
It logs get huge, find out why. Check the log before it gets out of hand - a simple "tail -n 15" should get you some evidence. Basic "Diagnostics 101".

1 members found this post helpful.

startxfce4.log - 40.3GB
you should definitely find out what's going on there.
log files log errors.
big log files == many errors.

1 members found this post helpful.

Try reading some of that log file with the head or tail commands and post it here.

1 members found this post helpful.

Thanks a lot, syg00. I guess the huge file left then because it was rotated out? And I'm not sure how to apply the "tail -n 15" command if you could elaborate on that.

Thanks ondoho. Yeah, I guess a ton of errors. It's just startling that it comes on so quickly. The first time it happened I watched everything closely for a week but then forgot about it, then pow, it happened again in one day. Unfortunately, that 40.3 log is gone so I can't analyze it, but I'll be watching the new log closely.

Hi Hydrurga. Thanks. I'm not quite sure how to do the head or tail commands. And the huge 40.3GB log is gone. And (I mean, I'm very strongly assuming you wouldn't have me post something that would) when I post a log like head/tail publicly I'm always worried it's going to reveal something (passwords or whatever) that puts the computer at risk to hackers. Is that something I need to be concerned about? Or how about when people in LQ ask me to run other commands and ask me to post the results? Is any security info ever revealed that way?

I learned about Glogg and got it from Synaptic, so I'm able to look at the current log, but I'm not really sure what I'm looking for. Just a ton of error messages? (In today's, very small, log it was just various error messages. It seemed none had corresponding sizes attached to them.)

Check one of the gz files - that's where the previous data is. Just zcat it and pipe to tail.

1 members found this post helpful.

Thanks but can you break that down for me? What I normally would do is extract the .gz file to a folder and look at the contents that way. I don't know how to zcat it and pipe to tail. Thanks.

Change the filename as appropriate.
That will dump the last 15 lines to stdout - could of course be redirected to a file if desired.

1 members found this post helpful.

Thanks syg00. I ran the command and all 15 entries were "SendMessage" followed by four sets of numbers.

Thanks everybody. Now I can keep an eye on that big log file with the head and tail -n 15. Hopefully I can see what's causing the sudden growth.