If you're reading this, maybe you're running out of free space on your disk and or you are a good reader of this blog ❤️. Anyway, we'll discuss how to list the largest files on your disk, then if it's the logs, we will see a way to avoid getting a large log file. Sometimes, it can lead to boot failure. So this tutorial will assume you are on recovery mode or log in as root.
1. Where is the largest file on the disk?
To find the largest file on your disk
du -ahx / | sort -nr | head
if you want to show only the top 20
du -ahx / | sort -nr | head -n 20
If the result shows some files from /var/log, it's a log problem.
2. Backup the files (optional but recommended)
If you have a USB drive, plug it in and copy the file for further investigation.
first, check if it is recognized
fdisk -l
Then mount it in a temporary folder
mkdir -p ~/temp
mount /dev/sdb1/ ~/temp
mkdir -p ~/temp/log-backup
Finally, copy the file to the drive
cp /var/log/kern.log ~/temp/log-backup
3. Setup logrotate
Logrotate allows you to limit the size of the log files found in /var/log.
For each log file, logrotate performs 2 operations:
- The rotation: it archives the log file under another name and deletes the oldest archive
- The compression: it optionally compresses the log file before archiving it.
Compression decreases used disk space but increases the amount of data read and written to the disk(It can lead to a disk failure) and energy consumption too.
On Ubuntu, starting from Ubuntu 16.04, the systemd journal is not managed by logrotate but by The journal and the logs can be found in /var/log/journal
It is preinstalled on most Debian-based distributions but if it's not installed, just hit
apt install logrotate
Now it's time to say goodbye to our big log file.
echo "" > /var/log/kern.log
Now let's configure logrotate, edit the file concerning your log file
nano /etc/logrotate.d/rsyslog
Add this line maxsize 1G to the block concerning your log file
Finally, the file should look like this
/var/log/syslog
{
rotate 7
daily
maxsize 1G
missingok
notifempty
delaycompress
compress
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
weekly
maxsize 1G
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
Enjoying our content? share with a friend, on Twitter.
Any question? Any suggestion? Tell me in the comment section