Hermann Kao

Hermann Kao

A geek and a big dreamer.

https://itishermann.me Limoges, France
2 min read

If you're reading this, maybe you're running out of free space on your disk and or you are a good reader of this blog ❤️. Anyway, we'll discuss how to list the largest files on your disk, then if it's the logs, we will see a way to avoid getting a large log file. Sometimes, it can lead to boot failure. So this tutorial will assume you are on recovery mode or log in as root.

1. Where is the largest file on the disk?

To find the largest file on your disk

du -ahx / | sort -nr | head

if you want to show only the top 20

du -ahx / | sort -nr | head -n 20

If the result shows some files from /var/log, it's a log problem.

If you have a USB drive, plug it in and copy the file for further investigation.

first, check if it is recognized

fdisk -l

Then mount it in a temporary folder

mkdir -p ~/temp
mount /dev/sdb1/ ~/temp
mkdir -p ~/temp/log-backup

Finally, copy the file to the drive

cp /var/log/kern.log ~/temp/log-backup

3. Setup logrotate

Logrotate allows you to limit the size of the log files found in /var/log.

For each log file, logrotate performs 2 operations:

  • The rotation: it archives the log file under another name and deletes the oldest archive
  • The compression: it optionally compresses the log file before archiving it.

Compression decreases used disk space but increases the amount of data read and written to the disk(It can lead to a disk failure) and energy consumption too.

On Ubuntu, starting from Ubuntu 16.04, the systemd journal is not managed by logrotate but by The journal and the logs can be found in /var/log/journal

It is preinstalled on most Debian-based distributions but if it's not installed, just hit

apt install logrotate

Now it's time to say goodbye to our big log file.

echo "" > /var/log/kern.log

Now let's configure logrotate, edit the file concerning your log file

nano /etc/logrotate.d/rsyslog

Add this line maxsize 1G to the block concerning your log file

Finally, the file should look like this

/var/log/syslog
{
rotate 7
daily
maxsize 1G
missingok
notifempty
delaycompress
compress
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
weekly
maxsize 1G
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}

Enjoying our content? share with a friend, on Twitter.
Any question? Any suggestion? Tell me in the comment section