Question

2

var/log/ is getting very big

rated 0 times [ 2] [ 0] / answers: 1 / hits: 1995 / 2 Years ago, thu, july 21, 2022, 7:43:18

So I looked and examine my disk and I figured out that my var/log/ is taking up about 100+ GB.

How would I reduce the size of my /var/log/?

Here are the results of tail -f /var/log/syslog

Mar 22 23:00:21 usr-MS-7C94 kernel: [44313.727104] audit: type=1400 audit(1647961221.527:631876): apparmor="DENIED" operation="ptrace" profile="snap.discord.discord" pid=25795 comm="Discord" requested_mask="read" denied_mask="read" peer="unconfined"

Mar 22 23:00:21 usr-MS-7C94 kernel: [44313.727085] audit: type=1400 audit(1647961221.527:631874): apparmor="DENIED" operation="open" profile="snap.discord.discord" name="/proc/2611/cmdline" pid=25795 comm="Discord" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Results of ls -alhS /var/log | more

total 59G

-rw-r-----   1 syslog            adm              46G Mar 23 19:19 kern.log

-rw-r-----   1 syslog            adm              13G Mar 23 08:04 syslog.1

-rw-r-----   1 syslog            adm             808M Mar 22 07:45 syslog.2.gz

-rw-r-----   1 syslog            adm              48M Mar 20 15:47 kern.log.1

-rw-r-----   1 syslog            adm             1.6M Mar 23 21:42 syslog

Results of ls -lh /var/log

total 59G

-rw-r--r--  1 root              root            6.2K Mar 21 08:13 alternatives.log

-rw-r--r--  1 root              root            8.3K Feb 23 19:46 alternatives.log.1

-rw-r-----  1 root              adm             1.3K Mar 23 09:47 apport.log

-rw-r-----  1 root              adm             5.0K Mar 22 21:52 apport.log.1

-rw-r-----  1 root              adm              988 Mar 21 21:02 apport.log.2.gz

OS:
Ubuntu Studio 20.04

Note:

After getting a notification that I am running low on space, I encountered an error while booting up that says
overlayfs: missing 'lowerdir' which I suspect is a problem connected with my storage problem

and I already deleted my *.gz files

Thank you so much~!

SOLVED===

Taken from the suggestions and answers given, I uninstalled the snap version of Discord and replaced it with the *.deb from the main Discord Website

I then executed

cd /var/log

sudo su

> lastlog

> wtmp

> dpkg.log 

> kern.log

> syslog

exit

Taken from this thread
Very large log files, what should I do?

And report from ls -alhS /var/log | more shows smaller sizes of logs and more /var/log/kern.log showed no repeating errors

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

oatglori

Add To Favorites

Follow

Total Points: 313

Total Questions: 102

Total Answers: 111

Location: Guam

Member since Thu, May 18, 2023

1 Year ago

oatglori questions

1 How to remove Duplicate LibreOffice 7.3.5.2 (Ubuntu & Manually Installed)

Tue, Nov 2, 21, 15:26, 3 Years ago

1 show previews command on terminal?

Mon, Apr 4, 22, 10:26, 2 Years ago

1 How to edit the aliases with which a program in Ubuntu is associated (and therefore will be returned in the search menu)

Sun, Nov 6, 22, 17:36, 2 Years ago

1 Changing zsh-autosuggestions color

Sat, Dec 11, 21, 17:45, 2 Years ago

1 How can I type "å" on a non-Danish keyboard?

Fri, Jun 24, 22, 00:14, 2 Years ago

View All

answered 2 Years ago anoalk · Accepted Answer

re: overlayfs: missing 'lowerdir'

Let's first check your file system...

boot to a Ubuntu Live DVD/USB in “Try Ubuntu” mode

open a terminal window by pressing Ctrl+Alt+T

type sudo fdisk -l

identify the /dev/sdXX device name for your "Linux Filesystem"

type sudo fsck -f /dev/sdXX, replacing sdXX with the number you found earlier

repeat the fsck command if there were errors

type reboot

Update #1:

/var/log/syslog is showing that the snap version of the nasty Discord program is acting up. /var/log/kern.log may show the same.

The snap version of Discord tries to work outside of its sandbox, and spams syslog and auth.log. Suggest removing the snap version sudo snap remove discord, and installing the APT/DEB version... https://discord.com/download. Otherwise you'll need to allow Discord privs that are normally not granted to shut it up.

If you show me the first 5 lines of output of ls -alhS /var/log | more I suspect that syslog and auth.log are probably very large. After removing the snap version of Discord, and installing the APT/DEB version of Discord, you can delete these large log files with:

sudo rm -i /var/log/syslog*

sudo rm -i /var/log/auth.log*

sudo rm -i /var/log/kern.log*