Huge discrepancy in log file size, can't start log2ram

Hi - I am trying to use log2ram, but even though I have made the ram drive as large as 400M (ten+ times what I should need, it's a RPi with debian and recently put together), it crashes with the complaint that there isn't enough space for /var/hdd.log.

Running du -sh on /var/log gives me a total of 649M (!!)
Running ls -sSh, however, only 13M (see below, and the directories below /var/log are all very small as well). I deleted old logs (.2+, .gz, etc) - nothing helps.

Why that gigantic difference? Ideas what to look for? TIA!

total 13M
-rw-rw----  1 root utmp            9.9M Jan 17 07:17 btmp
-rw-r-----  1 root adm             664K Jan 17 08:20 syslog
-rw-r-----  1 root adm             392K Jan 17 08:16 daemon.log
-rw-r-----  1 root adm             389K Jan 17 08:21 auth.log
-rw-rw-r--  1 root utmp            287K Jan 17 08:15 lastlog
-rw-r-----  1 root adm             183K Jan 17 08:15 messages
-rw-r--r--  1 root root            130K Jan 14 14:50 dpkg.log
-rw-rw-r--  1 root utmp            125K Jan 17 08:15 wtmp
-rw-r-----  1 root adm             108K Jan 17 08:15 kern.log
-rw-------  1 root root             54K Jan  1 00:01 boot.log.5
-rw-r-----  1 root adm              44K Jan 17 08:15 user.log
-rw-------  1 root root             37K Jan 17 08:14 vncserver-x11.log.bak
-rw-r--r--  1 root root             24K Jan  1 20:39 faillog
-rw-------  1 root root             14K Jan 17 08:15 vncserver-x11.log
-rw-r-----  1 root adm              12K Jan 17 08:15 debug
-rw-r--r--  1 root root            8.6K Jan 17 08:14 Xorg.0.log.old
-rw-r--r--  1 root root            8.5K Jan 17 08:14 Xorg.0.log
-rw-------  1 root root            7.1K Jan 17 08:14 boot.log
-rw-------  1 root root            6.8K Jan 16 00:00 boot.log.2
-rw-r--r--  1 root root            4.4K Jan  1 21:16 fontconfig.log
drwxr-x---  2 root adm             4.0K Jan 17 00:00 apache2
drwxr-xr-x  2 root root            4.0K Jan 14 14:47 apt
drwxr-xr-x  2 root root            4.0K Jan 17 00:00 cups
drwxr-xr-x  2 root root            4.0K Dec 25  2020 firebird
drwxr-xr-x  3 root root            4.0K Sep 21 17:12 hp
drwxr-sr-x+ 3 root systemd-journal 4.0K Sep 21 17:34 journal
drwx--x--x  2 root root            4.0K Jan 17 08:14 lightdm
drwx------  2 root root            4.0K Sep 21 17:34 private
drwxr-xr-x  3 root root            4.0K Sep 21 17:06 runit
drwxr-x---  3 root adm             4.0K Jan 16 20:26 samba
-rw-r--r--  1 root root            2.5K Jan  1 20:33 alternatives.log
-rw-r--r--  1 root root               0 Sep 21 17:34 bootstrap.log
-rw-r--r--  1 root root               0 Jan 17 08:24 out.txt

Something somewhere thinks it has a file open when it's orphaned. Try rebooting the Pi and see if that helps. It's possible something tried to delete or modify a file that was opened by something else and there's rogue file handles floating around.

Thanks. I thought I did try that and it didn't change. But tried again - still no good. du -sh /var/log still gets me 50ish times the directory size I get with ls -sSh /var/log. I am baffled ...

Try the following:

cd /var/log
du -chx --max-depth=1

That'll show you the size of each of the top level folders, you may find your "eaten" space there.

Ah. The journals directory had all that in it. I deleted them all and almost immediately one file came back at 17M and has since grown to 25M. Now I have to figure out who is so verbose. On first glance journalctl -n 50 shows nothing in the recent additions to the journal ….