2

Yesterday I had almost 21 GB free on the SSD on which is Ubuntu installed.
Last night I was downloading a file about 800 MB... then I forgot to turn off the laptop...

Today I logged into Ubuntu and was faced with a warning saying that I have only 3 GB free space! Two minutes later I checked my root partition and saw that I have only 75 MB free space left!

Now I'm trying to uninstall some unnecessary applications from Software Center, but I can't uninstall any applications. I rebooted the OS, and tried to uninstall apps again, but I still can't do it, and neither can I update the OS using Software Center.

I'm using Ubuntu 17.04

I have 2 partitions, root and swap.

Can malware cause this problem?

What happened? What should I do?

df -h output:

Filesystem      Size  Used Avail Use% Mounted on
udev            7.8G     0  7.8G   0% /dev
tmpfs           1.6G   10M  1.6G   1% /run
/dev/sda1        58G   52G  2.6G  96% /
tmpfs           7.8G  100K  7.8G   1% /dev/shm
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           7.8G     0  7.8G   0% /sys/fs/cgroup
/dev/loop0      2.8M  2.8M     0 100% /snap/telegram-cli/22
/dev/loop1       60M   60M     0 100% /snap/notes/4
/dev/loop2      199M  199M     0 100% /snap/instagraph/31
/dev/loop3       82M   82M     0 100% /snap/core/2898
/dev/loop4      136M  136M     0 100% /snap/gimp/25
/dev/loop5      138M  138M     0 100% /snap/gimp/20
/dev/loop6       82M   82M     0 100% /snap/core/2844
tmpfs           1.6G  188K  1.6G   1% /run/user/1000
/dev/sdb5       367G  105G  244G  30% /media/msi/49e9738d-627e-4fca-b2f8-761203da60df
/dev/sda6        58G   12G   43G  21% /media/msi/7191eee5-72bd-40a7-9b1f-e4e6f6d20e80

sudo du -hd 1/ output:

32K ./.gnome
52K ./Desktop
40K ./PycharmProjects
28K ./Documents
260K    ./git
127M    ./.vscode
1.7M    ./.nv
341M    ./.xdm
42M ./.PyCharmCE2017.2
4.0K    ./Public
8.0K    ./.mplayer
24K ./.gconf
164K    ./.java
340K    ./VirtualBox VMs
24M ./Pictures
134M    ./msi-keyboard-gui-linux-x64
614M    ./PhpStorm-172.3317.83
44K ./.compiz
32M ./.mozilla
205M    ./.tor-browser-en
76K ./.pki
28K ./.moc
1.1G    ./.wine
648K    ./.eclipse
12K ./.idlerc
117M    ./Downloads
5.3M    ./env
4.0K    ./Videos
20G ./.local
608K    ./.atom
16M ./.PhpStorm2017.2
16K ./.p2
64K ./.WorldOfGoo
8.0K    ./.conda
3.7M    ./.thunderbird
411M    ./.PlayOnLinux
48K ./.vpnoneclick
12K ./.dbus
4.0K    ./Templates
4.0K    ./Music
12M ./psiphon
159M    ./.config
8.0K    ./.swt
68K ./.ipython
924M    ./.cache
1.4M    ./eclipse-workspace
20K ./.byteexec
4.0K    ./bin
25M ./.lantern
364K    ./.kde
64M ./snap
8.0K    ./.pylint.d
270M    ./opt
24K ./.steam
68K ./.tooling
24G .

Output of sudo du -hd 1 ~/.local/share:

360K    /home/msi/.local/share/gvfs-metadata
14M /home/msi/.local/share/zeitgeist
12K /home/msi/.local/share/icc
1.5M    /home/msi/.local/share/icons
4.0K    /home/msi/.local/share/unity-settings-daemon
232K    /home/msi/.local/share/shotwell
4.0K    /home/msi/.local/share/ibus-table
536K    /home/msi/.local/share/Foxit Software
8.0K    /home/msi/.local/share/nautilus
4.0K    /home/msi/.local/share/sounds
12K /home/msi/.local/share/gnome-mines
52K /home/msi/.local/share/webbrowser-app
19G /home/msi/.local/share/Steam
104K    /home/msi/.local/share/keyrings
32K /home/msi/.local/share/desktop-directories
60K /home/msi/.local/share/grilo-plugins
867M    /home/msi/.local/share/umake
4.0K    /home/msi/.local/share/previews
288K    /home/msi/.local/share/gnome-software
128M    /home/msi/.local/share/TelegramDesktop
4.0K    /home/msi/.local/share/gnome-settings-daemon
188K    /home/msi/.local/share/rhythmbox
204K    /home/msi/.local/share/applications
4.0K    /home/msi/.local/share/libertine
8.0K    /home/msi/.local/share/JetBrains
16K /home/msi/.local/share/vulkan
976K    /home/msi/.local/share/app-info
4.0K    /home/msi/.local/share/totem
176K    /home/msi/.local/share/mime
8.0K    /home/msi/.local/share/webkitgtk
16K /home/msi/.local/share/Trash
40K /home/msi/.local/share/ubuntu-download-manager
8.0K    /home/msi/.local/share/vlc
152K    /home/msi/.local/share/evolution
4.0K    /home/msi/.local/share/gnome-shell
20G /home/msi/.local/share

I installed steam 2 weeks ago, so it isn't causing this problem.

Forgot to say:
When I woke up... I saw the laptop login screen was on. It didn't turn off all night... and I saw the password input box in the login sceen was filling up with characters like: ******************************************************************

My root partition /dev/sda1 has 58 GB space

Update:

I think I found where the problem is. 

$ sudo apt install ncdu
$ ncdu
. 114.7 GiB [##########] /media                                                 
.  23.6 GiB [##        ] /home
.  19.6 GiB [#         ] /var
    5.5 GiB [          ] /usr
.   2.5 GiB [          ] /snap
    1.9 GiB [          ] /opt
  687.2 MiB [          ] /lib
  127.1 MiB [          ] /boot
.  14.9 MiB [          ] /etc
   11.3 MiB [          ] /sbin
   11.1 MiB [          ] /bin
.  10.1 MiB [          ] /run
    4.9 MiB [          ] /lib32
.  76.0 KiB [          ] /tmp
!  16.0 KiB [          ] /lost+found
.  12.0 KiB [          ] /dev
    4.0 KiB [          ] /lib64
e   4.0 KiB [          ] /srv
!   4.0 KiB [          ] /root
e   4.0 KiB [          ] /mnt
e   4.0 KiB [          ] /cdrom
!   4.0 KiB [          ] /Desktop
.   0.0   B [          ] /proc
.   0.0   B [          ] /sys
@   0.0   B [          ]  initrd.img.old
@   0.0   B [          ]  initrd.img
@   0.0   B [          ]  vmlinuz.old
@   0.0   B [          ]  vmlinuz

I realized that there is a file named:syslog.1 in /var directory. the size of the file is: 19 GB, so I think this is the problem! but can I delete it? What happens if I do that?

Image from /var/log/syslog.1:

file browser open on /var/log directory

Sss
  • 1,022
  • Could you please run df -h and lsblk and paste the output in your question? – marko Oct 06 '17 at 09:13
  • @marko edited... – Sss Oct 06 '17 at 09:18
  • You just one partition, not three, run sudo du -hd 1 / and paste the result please be patient it might take a bit of time. With we will see where all the space has gone! – George Udosen Oct 06 '17 at 09:19
  • I know... I'm using other linux OS's swap partition... @George – Sss Oct 06 '17 at 09:21
  • 1
    Ok so / is definitely pretty much maxing out. There is a command line tool that you can use that analyzes disk space usage and it shows it nicely . Run sudo apt install ncdu and then run the command ncdu - take a look, I think you will like it. – marko Oct 06 '17 at 09:22
  • Ok run that code I gave so we know what's eating up the space – George Udosen Oct 06 '17 at 09:22
  • Ok I see this 20G ./.local . so go in there and see what happened! And my command was sudo du -hd 1 / not sudo du -hd 1, please rerun if you made that error and repaste. – George Udosen Oct 06 '17 at 09:26
  • 20G ./.local 24G . where . is the current working dir. – marko Oct 06 '17 at 09:27
  • I've seen something similar when a faulty driver was taking 100% of the CPU and logging the same message to the log file until it run out of space. – Katu Oct 06 '17 at 09:40
  • @George in ./.local ... there are steam's files! game:dota 2:)... but this is not what i'm looking for... I've installed steam about 2weeks ago... – Sss Oct 06 '17 at 10:13
  • Ok what then are you looking for? – George Udosen Oct 06 '17 at 10:14
  • @katu I don't think this is about CPU usage... cause just turn on my lptp and faced this error... nothing was using cpu... no apps no games... – Sss Oct 06 '17 at 10:16
  • @George ... there must be some other thing that is using 20GB ! except steam... can u find out? – Sss Oct 06 '17 at 10:19
  • run sudo du -hd 1 ~/.local and it should tell you what is using what in there! – George Udosen Oct 06 '17 at 10:30
  • @George i saw what was there... the game:dota 2 .... but i installed it 2weeks ago! please check my edited question again – Sss Oct 06 '17 at 10:34
  • @marko i use that command: "sudo apt install ncdu" and "ncdu" ... found the problem... thank u...please check my edited question... – Sss Oct 06 '17 at 11:12
  • 2
    This is a rotated log (the .1, rather than no numeric suffix, indicates that) so you can simply delete the file and nothing will go wrong. However, you may want to look in it first (and in syslog), as maybe something is wrong on your system that is producing numerous diagnostic messages. See How do I stop /var/log/kern.log.1 from consuming all my disk space? (which applies even though your file is syslog.1 instead of kern.log.1). If you ever get this with a non-rotated log, see Very large log files, what should I do? – Eliah Kagan Oct 06 '17 at 11:25

2 Answers2

2

You've got a stuck key on the keyboard. The stuck key is generating failed login requests that are filling up your logs.

Unplug the keyboard and use an external keyboard to prove this. This goes for both laptop and desktop machines.

ps: don't delete the syslog and syslog.1 files until you've reviewed them, as they're your only record of what went wrong

ps2: you've got a smallish SSD that may not be partitioned optimally. Show me a screenshot of gparted and tell me what's on sda6. Is sdb5 an external disk?

heynnema
  • 70,711
  • Stuck key sounds like a good possibility. Another issue if an Asus system. Asus x555u w/o pci=nomsi - space issue on drive and runaway log files filling drive https://ubuntuforums.org/showthread.php?t=2327103&page=3 – oldfred Oct 07 '17 at 03:42
  • I deleted it with "sudo rm /var/log/syslog.1" before i get both answers... by this link https://askubuntu.com/questions/239455/how-do-i-stop-var-log-kern-log-1-from-consuming-all-my-disk-space like Eliah Kagan said: (nothing will goes wrong) after that... i read this: https://askubuntu.com/questions/515146/very-large-log-files-what-should-i-do ... i understand that what i've done was not good... anyway i have the 19GB free space now... if something goes wrong i'll google or ask here... thank u for the attention and answers – Sss Oct 07 '17 at 09:10
  • To recover from the error you have made, this 'should' do it (haven't tried it though). Type sudo touch /var/log/syslog.1 and then change the permissions to: -rw-r-----. These are the permissions on my installation so it should be the same for yours too. – marko Oct 07 '17 at 09:23
0

Ok good work, thanks for installing ncdu now all you need to do is clear the /var/log/syslog.1 but there is a special way to do this, do not delete the file because the file is needed and even if you create it manually, it will have the incorrect permissions. According to this link you can clear a log file with the following command:

> /path/to/log-file

example:

> /var/log/syslog.1

but before that, you must become root as with sudo it will not work. To temporarily become root you need to run the following command:

sudo -s

then you just run:

> /var/log/syslog.1

and that should do it. It will clear the space. Although this is not the proper way, it does the job. Please make sure you read the link I provided, it talks about log rotation, you need to rotate the logs rather than clearing them.

P.S. I just ran > /var/log/syslog.1 on my Ubuntu 16.04.3 and it worked fine.

If this answer helped you, please click the 'Accept` button.

Oh BTW, run sudo apt install shutter

It is a snipping tool that you can use to take screenshots.

EDIT: Additionally, if you want to inspect what went wrong, do not clear the log files as other posters have responded.

marko
  • 928