Something is filling up root partition

[petri0]

I get warning about there is too little space left on root partition (which is 10GB) the day after I cleaned and gained 2GB space. Something is filling up the partition far too quickly but what?

[killer de bug]

You should look in /var/log/
I'm pretty sure you have a problem and the logs are growing fast.

[Reorx]

By any chance, did you use BleachBit to clean???

[WharfRat]

I get warning about there is too little space left on root partition (which is 10GB) the day after I cleaned and gained 2GB space. Something is filling up the partition far too quickly but what?

10GB is a little tight. What does this show:

Code: Select all

sudo du / -xhd1 --exclude={/run/,proc,/dev,/media,/mnt,/sys,/tmp}

[petri0]

By any chance, did you use BleachBit to clean???

Nope, no BleachBit here.

[petri0]

I get warning about there is too little space left on root partition (which is 10GB) the day after I cleaned and gained 2GB space. Something is filling up the partition far too quickly but what?

10GB is a little tight. What does this show:

Code: Select all

sudo du / -xhd1 --exclude={/run/,proc,/dev,/media,/mnt,/sys,/tmp}

Problem is that root filled up in couple of days from 1,8GB free space to 380MB.

Code: Select all

sudo du / -xhd1 --exclude={/run/,proc,/dev,/media,/mnt,/sys,/tmp}
[sudo] password for petri: 
15M	/sbin
2,5G	/var
16M	/root
4,0K	/cdrom
666M	/opt
16K	/.kde
9,7M	/bin
25M	/etc
4,0K	/lib64
340M	/lib
48M	/boot
4,9G	/usr
4,0K	/srv
16K	/lost+found
3,5M	/lib32
8,5G	/

In /var/log the biggest files are kern.log with 911MB and syslog also with 911MB

[petri0]

You should look in /var/log/
I'm pretty sure you have a problem and the logs are growing fast.

Yes there are two logs which are big (see post above) but how or what to seek in those?

[killer de bug]

post the tail of the bigger logs. Otherwise we don't know what is wrong with your system.

[petri0]

post the tail of the bigger logs. Otherwise we don't know what is wrong with your system.

Sorry but I don't know that command.

[cholq]

post the tail of the bigger logs. Otherwise we don't know what is wrong with your system.

Sorry but I don't know that command.

open a terminal window and simply type:

Code: Select all

tail /var/log/<name of log>

It will just display the last 10 lines of that file in the terminal. Then you can copy and paste them here for others to review.

[WharfRat]

Also paste back

Code: Select all

ls -lhS /var/log/|head

[petri0]

Code: Select all

~ $ tail /var/log/syslog
Feb 10 18:09:00 htpc0 dbus[524]: [system] Activating service name='org.freedesktop.UDisks' (using servicehelper)
Feb 10 18:09:00 htpc0 dbus[524]: [system] Successfully activated service 'org.freedesktop.UDisks'
Feb 10 18:09:01 htpc0 bluetoothd[577]: hci0: Remove UUID (0x0011) failed: Busy (0x0a)
Feb 10 18:10:00 htpc0 kernel: [ 7378.456929] CE: hpet increased min_delta_ns to 20115 nsec
Feb 10 18:10:57 htpc0 kernel: [ 7435.986632] CE: hpet increased min_delta_ns to 30172 nsec
Feb 10 18:17:01 htpc0 CRON[8297]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Feb 10 18:45:18 htpc0 colord: device removed: xrandr-Pioneer Electronic Corporation-VSX-521-16843009
Feb 10 18:45:19 htpc0 colord: Device added: xrandr-Pioneer Electronic Corporation-VSX-521-16843009
Feb 10 18:47:13 htpc0 colord: device removed: xrandr-Pioneer Electronic Corporation-VSX-521-16843009
Feb 10 18:47:14 htpc0 colord: Device added: xrandr-Pioneer Electronic Corporation-VSX-521-16843009

Code: Select all

~ $ tail /var/log/kern.log
Feb 10 16:12:01 htpc0 kernel: [  299.812020] mce: [Hardware Error]: Machine check events logged
Feb 10 16:13:59 htpc0 kernel: [  417.756022] EXT4-fs (dm-2): error count since last fsck: 45
Feb 10 16:13:59 htpc0 kernel: [  417.756026] EXT4-fs (dm-2): initial error at time 1379750296: ext4_wait_block_bitmap:447
Feb 10 16:13:59 htpc0 kernel: [  417.756029] EXT4-fs (dm-2): last error at time 1418999443: __ext4_get_inode_loc:3910: inode 102891521: block 411566112
Feb 10 16:14:11 htpc0 kernel: [  430.044122] EXT4-fs (dm-4): error count since last fsck: 3
Feb 10 16:14:11 htpc0 kernel: [  430.044127] EXT4-fs (dm-4): initial error at time 1409927352: __ext4_get_inode_loc:3910: inode 104334449: block 417333351
Feb 10 16:14:11 htpc0 kernel: [  430.044131] EXT4-fs (dm-4): last error at time 1419683875: __ext4_get_inode_loc:3935: inode 104334009: block 417333323
Feb 10 16:15:22 htpc0 kernel: [  500.507944] perf interrupt took too long (2503 > 2500), lowering kernel.perf_event_max_sample_rate to 50000
Feb 10 18:10:00 htpc0 kernel: [ 7378.456929] CE: hpet increased min_delta_ns to 20115 nsec
Feb 10 18:10:57 htpc0 kernel: [ 7435.986632] CE: hpet increased min_delta_ns to 30172 nsec

Code: Select all

~ $ ls -lhS /var/log/|head
totalt 1,7G
-rw-r----- 1 syslog            adm  870M feb 10 18:49 syslog
-rw-r----- 1 syslog            adm  870M feb 10 18:10 kern.log
-rw-r--r-- 1 root              root 376K feb 10 16:07 udev
-rw-r----- 1 syslog            adm  126K feb 10 07:59 syslog.1
-rw-r----- 1 syslog            adm  118K feb  7 20:45 kern.log.1
-rw-r--r-- 1 root              root  68K feb 10 18:47 Xorg.0.log
-rw-r--r-- 1 root              adm   62K feb 10 16:07 dmesg
-rw-r--r-- 1 root              adm   62K feb 10 13:13 dmesg.0
-rw-r----- 1 syslog            adm   45K feb 10 18:49 auth.log

[WharfRat]

Those file sizes are not out-of-line, there pretty much normal.

I'm not encouraged with these

Code: Select all

Feb 10 16:12:01 htpc0 kernel: [  299.812020] mce: [Hardware Error]: Machine check events logged
Feb 10 16:13:59 htpc0 kernel: [  417.756022] EXT4-fs (dm-2): error count since last fsck: 45

Since fsck is mentioned you might be on the verge of disk failure. I would immediately backup anything deemed important.

Also install smartmontools

Code: Select all

sudo apt-get install smartmontools

And paste back

Code: Select all

sudo smartctl -A /dev/sda

[petri0]

So it's sda which is coming to EOL? Well that one is the oldest by now.

Code: Select all

~ $ sudo smartctl -A /dev/sda
[sudo] password for petri: 
smartctl 6.2 2013-07-26 r3841 [x86_64-linux-3.19.0-32-generic] (local build)
Copyright (C) 2002-13, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF READ SMART DATA SECTION ===
SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x002f   200   200   051    Pre-fail  Always       -       0
  3 Spin_Up_Time            0x0027   175   174   021    Pre-fail  Always       -       6208
  4 Start_Stop_Count        0x0032   098   098   000    Old_age   Always       -       2413
  5 Reallocated_Sector_Ct   0x0033   200   200   140    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x002e   200   200   000    Old_age   Always       -       0
  9 Power_On_Hours          0x0032   078   078   000    Old_age   Always       -       16213
 10 Spin_Retry_Count        0x0032   100   100   000    Old_age   Always       -       0
 11 Calibration_Retry_Count 0x0032   100   100   000    Old_age   Always       -       0
 12 Power_Cycle_Count       0x0032   098   098   000    Old_age   Always       -       2149
192 Power-Off_Retract_Count 0x0032   200   200   000    Old_age   Always       -       153
193 Load_Cycle_Count        0x0032   166   166   000    Old_age   Always       -       104919
194 Temperature_Celsius     0x0022   124   089   000    Old_age   Always       -       26
196 Reallocated_Event_Count 0x0032   200   200   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0032   200   200   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0030   200   200   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x0032   200   200   000    Old_age   Always       -       0
200 Multi_Zone_Error_Rate   0x0008   200   200   000    Old_age   Offline      -       0

EDIT: Is it safe to just delete these two log files? They are created automatically again?

[killer de bug]

Those file sizes are not out-of-line, there pretty much normal.

Kern.log and syslog are 870Mb. This is HUGE!

[WharfRat]

Well there's some conflicting results here with the disk. Nothing shows any early signs of failing with that report

Check the usage of /var/cache/apt/archives/. Mine is currently as 7.6GB.

Code: Select all

du -hs /var/cache/apt/archives/

Those files can be safely removed with

Code: Select all

sudo apt-get clean

Force a disk check with

Code: Select all

sudo touch /forcefsck

and reboot.

Keep an eye on the log with

Code: Select all

egrep 'Error|fsck' /var/log/{kern.log,syslog}

Bottom line here with disk space is 10GB is awful tight.

If you haven't been running this a long time it might be beneficial to reinstall or expand the partition if possible.

[WharfRat]

Those file sizes are not out-of-line, there pretty much normal.

Kern.log and syslog are 870Mb. This is HUGE!

I'll concede that they are quite large, but not runaway large. I've seen them 2GB +

[killer de bug]

I'll concede that they are quite large, but not runaway large. I've seen them 2GB +

I consider that if my log files are bigger than 20Mb, there is a serious problem on-going. Most of the time they are lower than 1Mb.

[petri0]

Is it safe to just delete these two log files? They are created automatically again and not crashing the OS?

[PeterRJG]

Wow, apt-get clean removed about 1.25 Gb from /var. Does it store the files you download there or is the log itself just particularly verbose?