/var/log taking up 8.9 GB! What should I do?

Question

I am running Ubuntu 14.04 on my ASUS N550JV laptop. Just today I got a pop-up notification telling me that there were less than 100 MB in my root partition. I checked it and find /var/log is taking up 8.9G! I don't think this is normal. What should I do to solve this problem? Thanks in advance!

Update: I opened kernel.log and find there are millions of lines of this: kernel: [28044.142988] mei_me 0000:00:16.0: no destination client found 0x00002385, with different time. What is this?

The following is the output of ls -l /var/log

total 8696328                                                                                                                                        
-rw-r--r-- 1 root              root       2286 Sep 26 09:01 alternatives.log
-rw-r--r-- 1 root              root       4825 Aug 26 21:37 alternatives.log.1
-rw-r--r-- 1 root              root        301 Jul 22 23:10 alternatives.log.2.gz
-rw-r--r-- 1 root              root       2886 Jun 27 11:15 alternatives.log.3.gz
-rw-r--r-- 1 root              root       4337 May 26 20:06 alternatives.log.4.gz
-rw-r----- 1 root              adm        1728 Sep 26 11:42 apport.log
-rw-r----- 1 root              adm         402 Sep 25 09:54 apport.log.1
-rw-r----- 1 root              adm         268 Sep 21 11:29 apport.log.2.gz
-rw-r----- 1 root              adm         223 Sep 20 14:01 apport.log.3.gz
-rw-r----- 1 root              adm         285 Sep 18 00:40 apport.log.4.gz
-rw-r----- 1 root              adm         213 Sep 16 11:45 apport.log.5.gz
-rw-r----- 1 root              adm         399 Sep 15 23:15 apport.log.6.gz
-rw-r----- 1 root              adm         278 Sep 12 23:59 apport.log.7.gz
drwxr-xr-x 2 root              root       4096 Sep  1 09:50 apt
-rw-r--r-- 1 root              root          0 Jul  1 05:18 aptitude
-rw-r--r-- 1 root              root       1199 Jun  3 20:11 aptitude.1.gz
-rw-r--r-- 1 root              root        932 May 25 18:08 aptitude.2.gz
-rw-r----- 1 syslog            adm      106664 Sep 26 11:53 auth.log
-rw-r----- 1 syslog            adm       66437 Sep 21 09:52 auth.log.1
-rw-r----- 1 syslog            adm        6631 Sep 16 10:17 auth.log.2.gz
-rw-r----- 1 syslog            adm        6354 Sep  8 09:17 auth.log.3.gz
-rw-r----- 1 syslog            adm        5125 Aug 31 14:28 auth.log.4.gz
-rw-r--r-- 1 root              root       4933 Sep 26 11:43 boot.log
-rw-r--r-- 1 root              root      61649 Apr 16 21:21 bootstrap.log
-rw-rw---- 1 root              utmp        384 Sep  7 19:47 btmp
-rw-rw---- 1 root              utmp        384 Aug 21 08:16 btmp.1
drwxr-xr-x 2 root              root       4096 Sep  1 09:50 ConsoleKit
drwxr-xr-x 2 root              root       4096 Sep 26 08:57 cups
drwxr-xr-x 2 root              root       4096 Jun 26 10:20 dist-upgrade
-rw-r----- 1 root              adm       92504 Sep 26 11:43 dmesg
-rw-r----- 1 root              adm       93652 Sep 26 11:34 dmesg.0
-rw-r----- 1 root              adm       20020 Sep 25 09:55 dmesg.1.gz
-rw-r----- 1 root              adm       19899 Sep 21 12:57 dmesg.2.gz
-rw-r----- 1 root              adm       21037 Sep 21 11:29 dmesg.3.gz
-rw-r----- 1 root              adm       19060 Sep 21 09:51 dmesg.4.gz
-rw-r--r-- 1 root              root     232258 Sep 26 11:45 dpkg.log
-rw-r--r-- 1 root              root     247851 Aug 29 14:10 dpkg.log.1
-rw-r--r-- 1 root              root      15769 Jul 30 21:45 dpkg.log.2.gz
-rw-r--r-- 1 root              root      45116 Jun 28 18:47 dpkg.log.3.gz
-rw-r--r-- 1 root              root     120248 May 27 16:53 dpkg.log.4.gz
-rw-r--r-- 1 root              root      32032 Jul 11 04:41 faillog
-rw-r--r-- 1 root              root       4157 Sep  4 21:55 fontconfig.log
drwxr-xr-x 2 root              root       4096 Apr 16 21:21 fsck
-rw-r--r-- 1 root              root       1796 Sep 26 11:43 gpu-manager.log
drwxr-xr-x 3 root              root       4096 Apr 16 21:24 hp
drwxrwxr-x 2 root              root       4096 May 11 17:53 installer
-rw-r----- 1 syslog            adm  4448025426 Sep 26 11:57 kern.log                                                                                 
-rw-r----- 1 syslog            adm     1791471 Sep 21 10:14 kern.log.1
-rw-r----- 1 syslog            adm      544014 Sep 16 10:26 kern.log.2.gz
-rw-r----- 1 syslog            adm      597892 Sep  8 09:22 kern.log.3.gz
-rw-r----- 1 syslog            adm      365075 Aug 31 14:33 kern.log.4.gz
drwxr-xr-x 2 landscape         root       4096 May 23 22:42 landscape
-rw-rw-r-- 1 root              utmp     292292 Jul 11 04:41 lastlog
drwxr-xr-x 2 root              root       4096 Sep 26 11:43 lightdm
-rw-r--r-- 1 root              root         55 Sep 26 11:43 nvidia-prime-upstart.log
-rw-r--r-- 1 root              root     642192 Sep 26 11:43 pm-powersave.log
-rw-r--r-- 1 root              root     439992 Sep  1 09:16 pm-powersave.log.1
-rw-r--r-- 1 root              root       3106 Jul 31 21:28 pm-powersave.log.2.gz
-rw-r--r-- 1 root              root       4965 Jul  1 04:58 pm-powersave.log.3.gz
-rw-r--r-- 1 root              root       2878 Jun  1 14:09 pm-powersave.log.4.gz
-rw-r--r-- 1 root              root     848454 Sep 26 11:30 pm-suspend.log
-rw-r--r-- 1 root              root     447455 Sep  1 09:16 pm-suspend.log.1
-rw-r--r-- 1 root              root       6777 Jul 31 09:44 pm-suspend.log.2.gz
-rw-r--r-- 1 root              root      17905 Jun 30 20:39 pm-suspend.log.3.gz
-rw-r--r-- 1 root              root       7609 May 30 14:57 pm-suspend.log.4.gz
-rw-r--r-- 1 root              root         55 Sep 26 11:43 prime-offload.log
-rw-r--r-- 1 root              root         30 Sep 26 11:43 prime-supported.log
drwxr-x--- 2 root              adm        4096 Apr  3 23:33 samba
drwx------ 2 speech-dispatcher root       4096 Feb 19  2014 speech-dispatcher
-rw-r----- 1 syslog            adm  4446052235 Sep 26 12:02 syslog
-rw-r----- 1 syslog            adm     1205796 Sep 26 08:57 syslog.1
-rw-r----- 1 syslog            adm      166166 Sep 25 09:42 syslog.2.gz
-rw-r----- 1 syslog            adm      120637 Sep 23 09:38 syslog.3.gz
-rw-r----- 1 syslog            adm      165011 Sep 22 11:04 syslog.4.gz
-rw-r----- 1 syslog            adm       79713 Sep 21 10:14 syslog.5.gz
-rw-r----- 1 syslog            adm      105727 Sep 20 10:31 syslog.6.gz
-rw-r----- 1 syslog            adm      250437 Sep 19 14:07 syslog.7.gz
-rw-r--r-- 1 root              root     418771 Sep 26 11:43 udev
drwxr-xr-x 2 root              root       4096 May 11 18:01 unattended-upgrades
drwxr-xr-x 2 root              root      12288 Sep 26 11:34 upstart
-rw-rw-r-- 1 root              utmp     478464 Sep 26 11:43 wtmp
-rw-rw-r-- 1 root              utmp     579072 Aug 31 16:28 wtmp.1
-rw-r--r-- 1 root              root      31845 Sep 26 11:43 Xorg.0.log
-rw-r--r-- 1 root              root      32682 Sep 26 11:42 Xorg.0.log.old

Find out what is logging all that stuff in kern.log and syslog. 4 gigabytes in three hours is a lot. — Mark Plotnick, Sep 26 '14 at 16:50
syslog starts from today but kernel.log start from Sep 21. Each of them has over 40 million lines. — user274602, Sep 26 '14 at 17:30

David Foerster · Accepted Answer · 2016-01-14T16:21:04.617

As a quick fix

~~delete /var/log/syslog and restart the syslog daemon (sudo initctl restart rsyslog) or your entire system~~

Don't do this! While the chance is small, it may lead to issues with the syslog daemon or any other programs accessing that file. Instead,
truncate the log file in question to length 0:
```
sudo truncate -s 0 /var/log/syslog
```
This ensures the correct operation of all programs still writing to that file in append mode (which is the typical case for log files).

Beyond that something went wrong with your logrotate(8) task that's supposed to prevent overly large log files, but that is a bit more difficult to fix.

/var/log taking up 8.9 GB! What should I do?

1 Answers1