4

I use ubuntu 18.04. My root folder is almost full. I find that the /var/log/journal occupies large space. When I delete the file, it comes back in a few minutes and the file size comes back to hundreds MB. The output of the ls is like this:

 /var/log/journal/c546e8f977794e909808a0500f054869:ls
system@1eb5a486bc7f4296a6568e75eec38183-00000000007739a4-0005858aaa92734f.journal
system@1eb5a486bc7f4296a6568e75eec38183-0000000000775fa6-0005858ab4d45dd9.journal
system@1eb5a486bc7f4296a6568e75eec38183-000000000077878c-0005858ac510400c.journal
system@1eb5a486bc7f4296a6568e75eec38183-000000000077ae95-0005858ad1c2bd42.journal
system@1eb5a486bc7f4296a6568e75eec38183-000000000077d4df-0005858adc9695de.journal
system@1eb5a486bc7f4296a6568e75eec38183-0000000000780235-0005858b2d94c7ff.journal
system@1eb5a486bc7f4296a6568e75eec38183-0000000000782ff0-0005858b79eb4300.journal
system@1eb5a486bc7f4296a6568e75eec38183-000000000078576e-0005858bfdb01655.journal
system@1eb5a486bc7f4296a6568e75eec38183-0000000000786958-0005858c0098c52d.journal
system@1eb5a486bc7f4296a6568e75eec38183-00000000007895ff-0005858c09fe50b2.journal
system@1eb5a486bc7f4296a6568e75eec38183-000000000078bfd9-0005858c120cb12b.journal
system@1eb5a486bc7f4296a6568e75eec38183-000000000078e6db-0005858c3246c17f.journal
system@1eb5a486bc7f4296a6568e75eec38183-000000000078ff99-0005858c53cde262.journal
system@1eb5a486bc7f4296a6568e75eec38183-0000000000791865-0005858c733cc294.journal
system@1eb5a486bc7f4296a6568e75eec38183-000000000079417c-0005858c79fe7044.journal
system@1eb5a486bc7f4296a6568e75eec38183-00000000007968a4-0005858c99d8afbe.journal
system.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-0000000000771378-0005858a9d1d265d.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-0000000000773c53-0005858aab1ef5eb.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-000000000077622d-0005858ab53ee184.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-00000000007789e2-0005858ac556d15c.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-000000000077af6c-0005858ad1db3539.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-000000000077d4e8-0005858adc9764e1.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-00000000007802cb-0005858b2da7b6a2.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-0000000000782ff4-0005858b79eddb42.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-0000000000786ab7-0005858c00cda19e.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-0000000000789635-0005858c0a03ce1c.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-000000000078bfdb-0005858c120d633f.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-000000000078e6d5-0005858c3226413d.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-000000000078ff94-0005858c53c39b6e.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-0000000000791860-0005858c72c22ae2.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-0000000000794213-0005858c7a0e2b1d.journal
user-1000@a3af372661b448e59fdeb77c7a6b0f0d-000000000079688e-0005858c99c51f8e.journal
user-1000.journal

The content of the log is something like:

4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:05 kaiqiang-TM1701 kernel: i2c_hid i2c-ETD2303:00: i2c_hid_get_input: incomplete report (14/65535)
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.224 - 1042m40s DEBUG chained: overhead.go:22 App Traffic: 25 MB  Wire Traffic: 29 MB  Overhead: 14.62%
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.225 - 1042m40s DEBUG chained: overhead.go:22 App Traffic: 0 B  Wire Traffic: 0 B  Overhead: NaN%
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.234 - 1042m40s DEBUG balancer: balancer.go:576 ----------- Dialer Stats (17h22m39.696072082s) ----------- [op=client_st
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.235 - 1042m40s DEBUG balancer: balancer.go:584 fp-mskr1su16-20190221-221-lampshade    at    52.231.184.119:443 (t)  P: 
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.235 - 1042m40s DEBUG balancer: balancer.go:584 fp-mskr1cu16-20190220-357-lampshade    at   52.141.32.241:29665 (t)  P: 
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.235 - 1042m40s DEBUG balancer: balancer.go:584 fp-mshk1au16-20190206-028-lampshade    at    52.184.29.90:26641 (t)  P: 
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.235 - 1042m40s DEBUG balancer: balancer.go:584 fp-sbtk1au16-20190305-325-lampshade    at      47.245.55.38:443 (t)  P: 
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.235 - 1042m40s DEBUG balancer: balancer.go:584 fp-anhk1bu16-20190211-039-lampshade    at      47.52.200.77:443 (t)  P: 
4月 03 14:55:13 kaiqiang-TM1701 lantern.desktop[6701]: Apr 03 06:55:13.235 - 1042m40s DEBUG balancer: balancer.go:608 ----------- End Dialer Stats ----------- [op=client_started root_op=clie
li Kaiqiang
  • 61
  • 2
  • 6
  • What does the log contain? Please post the contents to you question. For it to get that large there must be something it is constantly recording or an ongoing error that is repeating many times. I had a similar issue on a raspberry pi where my logs where filling the sd card. Looking at the largest logs I could see that my sendmail config was problematic and the log was filling with thousands of repeat mail login attempts during the course of the day to the point the log file was taking up significant amounts of space. Chances are what's in the log will tell you what the problem is. – rohtua Apr 02 '19 at 12:04
  • I have just added the output of ls. – li Kaiqiang Apr 02 '19 at 14:26
  • 1
    ls is just the contents of the folder. To try and work out what's going on we need to look at the contents of the logs. Try posting the output of journalctl -n 50 that should show the last 50 entries from the logs. Have a look at the following link it explains how journalctl works quite nicely: https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs – rohtua Apr 02 '19 at 18:56
  • The contents are posted in the question. The "incomplete report" seems to appear many times in the sys.log too. – li Kaiqiang Apr 03 '19 at 07:00
  • 2
    Clearning out old journal logs can easily be done with "journalctl --vacuum-time=10d", where 10d is everything older than 10 days – Christian Benke Mar 13 '20 at 09:23
  • This question got a good answer a year later: https://askubuntu.com/questions/1238214/big-var-log-journal – j0h Aug 31 '23 at 16:47

0 Answers0