LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-02-2012, 12:27 PM   #1
Mcorbett1
LQ Newbie
 
Registered: Nov 2009
Location: Rural central Texas
Distribution: Ubuntu 10-04
Posts: 5

Rep: Reputation: 0
Var Log using up all my HD


I am using an older Dell laptop with only 26GB HD and running Ubuntu 11.04
I am getting messages telling me my HD is running out of room. As I explored this, I found that the log under var is using 20.1GB and growing a bit each time I turn on the computer. Can I safely delete the files in this log?
Thanks for any help you can give me.
Mike
 
Old 05-02-2012, 12:38 PM   #2
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
What is the log file name?

Traditionally the /var/ directory is set as a separate file system to prevent the hard drive from filling up and causing issues so if it does fill up it only affects that file system. /var/ is used mostly for storing log files of which they can usually be removed. However, the info inside may be of use depending upon the app that is logging it. Most apps will have a config file that you tell it what to log, for instance Apache HTTP web server has different levels you can set to log from warn to error, which one you select will tell Apache how much info to log and most apps have a similar directive you can modify to prevent this from re-occurring.
 
Old 05-02-2012, 12:47 PM   #3
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,946
Blog Entries: 14

Rep: Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161
Are you running Dell OpenManage (omsa) on the server? If so are the logs you talking about TTY_*?

Have a look at this thread:
http://lists.us.dell.com/pipermail/l...er/037452.html

The main logs in /var/log are those used by the system (with /var/log/messages being the main one). You can not simply delete logs usually because they are in active use by a process. When you delete an open file it deletes only the name but NOT the inode so doesn't free up space until the process goes away.

Instead log rotation routines such as that described in the above link should be used. By default RHEL5 does log rotation for several of the logs (including messages) in /var/log so you shouldn't need to delete things. It may be someone has adjusted your rotation or that you are getting so many messages that standard rotation doesn't suffice. In which case you might want to investigate WHAT is in the logs rather than how large they are. Perhaps you have something too verbose turned on? Something logging to this log that ought to log elsewhere? Some issue that you can fix to stop dozens of log messages? It doesn't help you to clear the size of the log if the real problem is something like the log being full of messages telling you / is full and you're not addressing that underlying issue.
 
Old 05-02-2012, 02:31 PM   #4
gajovy
LQ Newbie
 
Registered: May 2012
Posts: 4

Rep: Reputation: Disabled
Lightbulb

Quote:
Originally Posted by Mcorbett1 View Post
I am using an older Dell laptop with only 26GB HD and running Ubuntu 11.04
I am getting messages telling me my HD is running out of room. As I explored this, I found that the log under var is using 20.1GB and growing a bit each time I turn on the computer. Can I safely delete the files in this log?
Thanks for any help you can give me.
Mike
If you don't care for what's in these logs, yes you can delete the logs, but your problem will remain and make you do it over and over again after some time. I'd start with finding the log file which grows so fast.

Code:
cd /var/log
ls -lh
you'll see either a big file or several small (100MB) but with a common name. Examine them and see what is the problem. The file without dot number at the end is most recent and you should be able to see the cause by

Code:
tail -n20 <file_name>


______________________________________

Please also make sure you don't have an empty CD in your CD-ROM. I had this problem recently, what I've done was:
  1. removed an empty CD from the drive
  2. deleted old logs
    Code:
    rm -rf /var/log/syslog.*
  3. removed unnecessary lines from the most recent syslog file with
    Code:
    sed -i "/Make sure there is a disc in the drive./d" /var/log/syslog
 
Old 05-02-2012, 02:59 PM   #5
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
Doing an rm -rf to your log directory is not advised in most cases. Alot of times you will see issues with processes, esp syslog and other logging processes, removing and/or rotating log files but the process never kills so the inodes do not get removed/updated properly. This can cause your df -h to show 100% usage but du -sh will show much less. If this is the case you simply need to find the process that has the log file open:

Code:
ps auxww | grep /var/log/
Then you can kill the process or restart the associated daemon and the inodes should get removed properly and your disk usage be read correctly. This happened to me recently with VNC server and its logging.
 
Old 05-02-2012, 03:07 PM   #6
gajovy
LQ Newbie
 
Registered: May 2012
Posts: 4

Rep: Reputation: Disabled
Quote:
Originally Posted by Kustom42 View Post
Doing an rm -rf to your log directory is not advised in most cases. Alot of times you will see issues with processes, esp syslog and other logging processes, removing and/or rotating log files but the process never kills so the inodes do not get removed/updated properly. This can cause your df -h to show 100% usage but du -sh will show much less. If this is the case you simply need to find the process that has the log file open:

Code:
ps auxww | grep /var/log/
Then you can kill the process or restart the associated daemon and the inodes should get removed properly and your disk usage be read correctly. This happened to me recently with VNC server and its logging.
Right! Two remarks:
- it's a laptop, which I assume is restarted pretty often
- rm -rf /var/log/syslog.* will remove old rotated logs only, not the one syslog is writing to...
 
Old 05-02-2012, 08:21 PM   #7
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Debian, Mageia, and whatever VMs I happen to be playing with
Posts: 12,495
Blog Entries: 16

Rep: Reputation: 3208Reputation: 3208Reputation: 3208Reputation: 3208Reputation: 3208Reputation: 3208Reputation: 3208Reputation: 3208Reputation: 3208Reputation: 3208Reputation: 3208
Also, have a look at the logrotate settings. If logrotate is not set up as a cron job, it should be.

http://www.thegeekstuff.com/2010/07/logrotate-examples/
 
Old 05-03-2012, 08:53 AM   #8
Mcorbett1
LQ Newbie
 
Registered: Nov 2009
Location: Rural central Texas
Distribution: Ubuntu 10-04
Posts: 5

Original Poster
Rep: Reputation: 0
Thankyou for all the responses; however, I have been unable to solve the problem. I am not very literate in Linux code and was unable to get any response by pasting the suggestions into the terminal command box. What I will do at the completion of this message is to "nuke" the HD and reload Ubuntu. The only information I keep on the HD is the bookmarks in Firefox, which I can save and reload. I suspect that this problem will occur again in the future, but perhaps by then I can figure out how to cure or prevent it. It all seems to be tied into the "log" file in "Var", which just keeps growing. There are several files that seem to duplicate with extensions numbering 1 and upward to 10 or more. Example: Alternatives.log.5 gz and dmesg.1.gz. Although these are not large files, they keep growing in number.
Thanks again for your responses. Catch you on the "other side".
Mike
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
/var/log/wtmp vs. /var/run/utmp masenko703 Linux - Newbie 4 10-05-2012 03:41 AM
kernel log format in /var/log/kern.log sinu_nayak2001 Linux - Newbie 2 10-07-2009 08:34 AM
/var/log/messages and /var/log/cron not working sigkill Linux - Software 6 08-09-2008 01:08 PM
Can Samhain log my entries in /var/log/secure and /var/log/mesage to a central server abefroman Linux - Software 2 04-13-2008 04:13 PM
/var/log/packages and /var/log/setup sunny_5252 Slackware 4 05-17-2007 08:17 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 10:14 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration