LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Embedded & Single-board computer (https://www.linuxquestions.org/questions/linux-embedded-and-single-board-computer-78/)
-   -   Huge discrepancy in log file size, can't start log2ram (https://www.linuxquestions.org/questions/linux-embedded-and-single-board-computer-78/huge-discrepancy-in-log-file-size-cant-start-log2ram-4175721013/)

henry1964 01-17-2023 12:01 PM
Huge discrepancy in log file size, can't start log2ram
 
Hi - I am trying to use log2ram, but even though I have made the ram drive as large as 400M (ten+ times what I should need, it's a RPi with debian and recently put together), it crashes with the complaint that there isn't enough space for /var/hdd.log.

Running du -sh on /var/log gives me a total of 649M (!!)
Running ls -sSh, however, only 13M (see below, and the directories below /var/log are all very small as well). I deleted old logs (.2+, .gz, etc) - nothing helps.

Why that gigantic difference? Ideas what to look for? TIA!
Code:
total 13M
-rw-rw----  1 root utmp            9.9M Jan 17 07:17 btmp
-rw-r-----  1 root adm            664K Jan 17 08:20 syslog
-rw-r-----  1 root adm            392K Jan 17 08:16 daemon.log
-rw-r-----  1 root adm            389K Jan 17 08:21 auth.log
-rw-rw-r--  1 root utmp            287K Jan 17 08:15 lastlog
-rw-r-----  1 root adm            183K Jan 17 08:15 messages
-rw-r--r--  1 root root            130K Jan 14 14:50 dpkg.log
-rw-rw-r--  1 root utmp            125K Jan 17 08:15 wtmp
-rw-r-----  1 root adm            108K Jan 17 08:15 kern.log
-rw-------  1 root root            54K Jan  1 00:01 boot.log.5
-rw-r-----  1 root adm              44K Jan 17 08:15 user.log
-rw-------  1 root root            37K Jan 17 08:14 vncserver-x11.log.bak
-rw-r--r--  1 root root            24K Jan  1 20:39 faillog
-rw-------  1 root root            14K Jan 17 08:15 vncserver-x11.log
-rw-r-----  1 root adm              12K Jan 17 08:15 debug
-rw-r--r--  1 root root            8.6K Jan 17 08:14 Xorg.0.log.old
-rw-r--r--  1 root root            8.5K Jan 17 08:14 Xorg.0.log
-rw-------  1 root root            7.1K Jan 17 08:14 boot.log
-rw-------  1 root root            6.8K Jan 16 00:00 boot.log.2
-rw-r--r--  1 root root            4.4K Jan  1 21:16 fontconfig.log
drwxr-x---  2 root adm            4.0K Jan 17 00:00 apache2
drwxr-xr-x  2 root root            4.0K Jan 14 14:47 apt
drwxr-xr-x  2 root root            4.0K Jan 17 00:00 cups
drwxr-xr-x  2 root root            4.0K Dec 25  2020 firebird
drwxr-xr-x  3 root root            4.0K Sep 21 17:12 hp
drwxr-sr-x+ 3 root systemd-journal 4.0K Sep 21 17:34 journal
drwx--x--x  2 root root            4.0K Jan 17 08:14 lightdm
drwx------  2 root root            4.0K Sep 21 17:34 private
drwxr-xr-x  3 root root            4.0K Sep 21 17:06 runit
drwxr-x---  3 root adm            4.0K Jan 16 20:26 samba
-rw-r--r--  1 root root            2.5K Jan  1 20:33 alternatives.log
-rw-r--r--  1 root root              0 Sep 21 17:34 bootstrap.log
-rw-r--r--  1 root root              0 Jan 17 08:24 out.txt

TenTenths 01-18-2023 11:06 AM
Something somewhere thinks it has a file open when it's orphaned. Try rebooting the Pi and see if that helps. It's possible something tried to delete or modify a file that was opened by something else and there's rogue file handles floating around.

henry1964 01-18-2023 09:32 PM
Thanks. I thought I did try that and it didn't change. But tried again - still no good. du -sh /var/log still gets me 50ish times the directory size I get with ls -sSh /var/log. I am baffled ...

TenTenths 01-19-2023 03:27 AM
Try the following:
Code:
cd /var/log
du -chx --max-depth=1
That'll show you the size of each of the top level folders, you may find your "eaten" space there.

henry1964 01-19-2023 04:54 PM
Ah. The journals directory had all that in it. I deleted them all and almost immediately one file came back at 17M and has since grown to 25M. Now I have to figure out who is so verbose. On first glance journalctl -n 50 shows nothing in the recent additions to the journal ….


All times are GMT -5. The time now is 04:24 PM.