Can't login - hard disk is full due to massive log files

Question

I am running Elementary OS (5.1.6 Hera) on my laptop and everything was running fine. And then one day, I just couldn't log in. Entering the password just refreshed the screen and showed the interface for logging in again.
After doing a quick search online, I found out how to switch to Terminal Ctrl + Alt + F1 and log in through there. I tried to run a sudo apt-get update command to see if there were some updates that would fix the issue and got prompted with the error that my hard disk was full.
I ran some remove commands rm -rf directory on some folders within the Downloads directory and that freed up some space. I rebooted, which took me back to the interface for the login screen and I could log in fine.
I have a 250 GB hard drive. The total size of contents in my home folder amounts to 4.6 GB. I had no idea what is / has filled the other 245 GB. I tried running a sudo apt-get autoremove command and a sudo apt-get clean command to see if that would help - but it barely removed anything.
After doing some digging, it appears that in the /var/log directory there is over 200 GB of "stuff". Split between the file kern.log.1 and syslog.1 - both weighing in at 100 GB each.
The Code app doesn't really want to open a 100 GB log file, so I've not really looked inside the log files to see what's happening. But why would Elementary OS do this? What would make it generate a set of such a massive log files that it fills my hard disk and disables the ability to log in?

Lewis Goddard · Answer

I'm not sure what would cause those files to become so large, but you can safely delete rotated log files within that directory. This keeps the current log so you can still investigate any issues you might not be aware of.
List files to be deleted
sudo find /var/log -type f -regex ".*.[0-9]$"
sudo find /var/log -type f -regex ".*.gz$"

Delete files
sudo find /var/log -type f -regex ".*.[0-9]$" -delete
sudo find /var/log -type f -regex ".*.gz$" -delete

Stop logs becoming so large
This setting will allow 7 days of logs, each no larger than 1 GB. A similar system could be added for kern.log as well.
sudo nano /etc/logrotate.d/rsyslog and add maxsize option:
/var/log/syslog
{
    rotate 7
    daily
    maxsize 1G # add this line
    missingok
    notifempty
    delaycompress
    compress
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

Can't login - hard disk is full due to massive log files

One Answer

List files to be deleted

Delete files

Stop logs becoming so large

Add your own answers!

Ask a Question