Had a low-space warning, Google'd the problem (had 1.8GB free at the time), found topics about running $ sudo du -x -d1 -h /var | sort -hr and I did:

30G     /var
29G     /var/log
353M    /var/cache
315M    /var/lib
11M     /var/backups
72K     /var/spool
8.0K    /var/tmp
4.0K    /var/opt
4.0K    /var/mail
4.0K    /var/local

and df -h:

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda9        39G   36G 1021M  98% /
udev             10M     0   10M   0% /dev
tmpfs           788M  988K  787M   1% /run
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           2.0G   28M  2.0G   2% /run/shm
/dev/sda1       496M   52M  445M  11% /boot/efi
/dev/sda11      824G  337G  487G  41% /home/user/saved
none            4.0K     0  4.0K   0% /sys/fs/cgroup

In that time, I lost about a GB worth of space. Now I have 1.1GB of space.

I see the /var/log is eating about 80% of my partition, what do I do?

(Note: /dev/sda11 is my mounted data partition, and I also have a "safe" file that I save stuff on mounted on the path /home/user/saved as FAT32 can't do symbolic links, and it's been this way without problems)

PS. I'm on Linux Mint Debian Edition

UPDATE: Here's a look on the log folder: using ls -s

user@mint /var/log $ ls -s
    6379896 kern.log.1
    6379372 messages.1
    6377424 ufw.log.1
    2622576 kern.log
    2622504 messages
    2622224 ufw.log
    2613532 syslog.1
    146316 syslog.6.gz
    102076 kern.log.2.gz
    102044 messages.2.gz
    101840 ufw.log.2.gz
    98904 syslog.3.gz
    28216 syslog.7.gz
    22848 syslog.5.gz
    16996 syslog.2.gz
    15660 syslog.4.gz

user@mint /var/log $ sudo du -x -d1 -h /var/log | sort -hr
    29G /var/log
    148K    /var/log/apt
    88K /var/log/ConsoleKit
    56K /var/log/mdm
    44K /var/log/samba
    36K /var/log/tor
    36K /var/log/cups
    16K /var/log/clamav
    12K /var/log/fsck
    8.0K    /var/log/hp
    4.0K    /var/log/unattended-upgrades
    4.0K    /var/log/ntpstats`
  • Delete your old logs? – jasonwryan Jul 22 '14 at 4:31
  • I read it's not safe as applications need to see their log files to exist. How would I do that safely? can I just delete the whole /var/log? – Mars Jul 22 '14 at 4:32
  • No: don't do that... First, to free some space, delete the old logs only. Then identify what, if anything, is spamming your logs and causing them to balloon between rotations. – jasonwryan Jul 22 '14 at 4:33
  • I posted a picture of my log file, I'd greatly appreciate a help with the actual commands to do execute, I've been using Linux for just over a month. – Mars Jul 22 '14 at 4:40
  • 1
    ls -lShr would be even of more use, as it would be easier to compare for most people, and we can concentrate on the last files – Dani_l Jul 22 '14 at 4:49

Looks like a bunch of log files are out of control; kern.log, message, ufw.log, and syslog. Take a look inside them to see what is filling them up with so much information. Since ufw.log is so big, it's likely a firewall related problem. Note the the .1 files are rotated logs; they are the old log files that were moved out of the way for new ones. Once you've taken a look to see if there's anything interesting in them, you can delete them, leaving only the currently active log files.

I would suggest posting short excerpts from each of those logs, so we can give more help about what might actually be going wrong; then delete the .1 files (or compress them if you want to keep them but make them substantially smaller: gzip kern.log.1 messages.1 ufw.log.1 syslog.1).

  • I've reread your answer. I can safely delete .1 files. Would you help me on how to do it? i.e. would I just run rm [file name]? – Mars Jul 22 '14 at 5:02
  • @Mars You would run sudo rm <file name>. Yes, you can safely delete the .1 files. But first, look in them and post excerpts; if they are filling up that fast, there's likely some problem. Oh, and yes, if you forgot to turn "Full Logging" off in gufw, that could likely be the cause of the problem. Take a look in the logs and see! Just run less <logfile>, use the up an down arrows to navigate a line at a time, or spacebar to go down a page at a time; type ESC followed by > to go to the end of the log file, and "q" to quit out of less. – Brian Campbell Jul 22 '14 at 5:09
  • I deleted them already, lol. Used sudo rm -f kern.log.1 kern.log.2.gz messages.1 ufw.log.1 syslog.1 syslog.6.gz kern.log.2.gz messages.2.gz ufw.log.2.gz syslog.3.gz syslog.7.gz syslog.5.gz syslog.2.gz syslog.4.gz daemon.log.1 debug.1 I'd rather risk missing a log problem than dealing with them at this time. Thank you very much, now I have 23GB of free space. Thanks – Mars Jul 22 '14 at 5:13
  1. You can safely delete all files ending in .gz or .<number>.
  2. You might want to adjust your logrotate configuration.

Please paste the contents of /etc/logrotate.conf and/or /etc/logrotate.d/*.conf (star means any file) so we can help further.

  • Will delete those stuff then! I'll do that in a minute, just let me try deleting the big stuff first. – Mars Jul 22 '14 at 5:03
  • Thank you very much for your time! I can't vote up your answer due to low rep. – Mars Jul 22 '14 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.