Full Disk Warning

[YoMan]

Your advice is much appreciated. I will stick with it for a while before deciding whether to re-install. I need to study the command series you provided and read the "EasyLinuxTips...". I may (probably) have some questions for you after/during.
Interestingly, right after posting my last comments, I deleted the 4 Timeshiift folders. Now, 2 hours later, a new snapshot has appeared consisting of 300k items and 7.6 GB. I have it set to do weekly snapshots. So, shouldn't see any more til this time next week. Of course, the Properties dialog shows that /home/Timeshift = 7.8 GB.

[zcot]

Code: Select all

bill@wiliam-Yoga:~$ sudo du -hs /var/log
[sudo] password for bill:        
859M	/var/log

That's likely bigger than is should be, and it especially is if you just deleted those logs. Look at what smurphos said. -tail the log. Don't pay much attention to the other stuff, although could be important or useful, in a minute, but there's every bit of appearance that the system is in duress of some issue, RIGHT NOW. So, easy, all you have to do is just take a live look at the log and see. It's either yes or no.

[LanceM]

I deleted the 4 Timeshift folders.

Always delete snapshots using Timeshift. Have you not been doing that in the past? If so it might well be the problem.

[pbear]

... I will stick with it for a while before deciding whether to re-install.

Prudent choice, given zcot's diagnosis. Maybe a hardware issue after all. Only way to find out is to leave the system running and collect data.

Understand, at this stage, you're not just trying to curb the logs. They're a symptom. You need to figure out why the logs are growing so fast, which you do by monitoring what errors are being reported.

[YoMan]

Yes. I ignorantly just deleted them with "delete". Should I now go back and delete the new one using Timeshift?

Following is the initial run of "tail":

Code: Select all

ill@wiliam-Yoga:~$ tail -f /var/log/syslog
May 27 15:43:03 wiliam-Yoga rtkit-daemon[1388]: Supervising 3 threads of 1 processes of 1 users.
May 27 15:43:03 wiliam-Yoga rtkit-daemon[1388]: message repeated 3 times: [ Supervising 3 threads of 1 processes of 1 users.]
May 27 15:43:03 wiliam-Yoga rtkit-daemon[1388]: Successfully made thread 16096 of process 16027 (n/a) owned by '1000' RT at priority 10.
May 27 15:43:03 wiliam-Yoga rtkit-daemon[1388]: Supervising 4 threads of 2 processes of 1 users.
May 27 15:43:04 wiliam-Yoga rtkit-daemon[1388]: message repeated 6 times: [ Supervising 4 threads of 2 processes of 1 users.]
May 27 15:55:58 wiliam-Yoga dbus-daemon[1260]: [session uid=1000 pid=1260] Activating via systemd: service name='org.gnome.Terminal' unit='gnome-terminal-server.service' requested by ':1.450' (uid=1000 pid=16308 comm="/usr/bin/gnome-terminal.real " label="unconfined")
May 27 15:55:58 wiliam-Yoga systemd[1225]: Starting GNOME Terminal Server...
May 27 15:55:58 wiliam-Yoga dbus-daemon[1260]: [session uid=1000 pid=1260] Successfully activated service 'org.gnome.Terminal'
May 27 15:55:58 wiliam-Yoga systemd[1225]: Started GNOME Terminal Server.
May 27 15:56:03 wiliam-Yoga gnome-terminal-[16311]: g_menu_insert_item: assertion 'G_IS_MENU_ITEM (item)' failed
May 27 15:58:07 wiliam-Yoga kernel: [33977.157996] wacom 0003:056A:5093.0005: wacom_wac_queue_insert: kfifo has filled, starting to drop events

I assume that if I leave the terminal window open, it will continue to run. How often will it check for new logs? Continuously? What should I watch for to know if something is not right? What happens if I shut the computer down? Will I need to re-start it?

[LanceM]

Yes. I ignorantly just deleted them with "delete". Should I now go back and delete the new one using Timeshift?

No, but in the future always use Timeshift. Otherwise Timeshift doesn't know they were deleted. I've seen similar problems to yours because of this, albeit not many.
I'm going to test something and will post a bit more.
Edit:
Ran some tests and this is what I'd do
Run those cleanup steps at the link then:
1. Use Timeshift to delete any snapshots
2. Using file manager, navigate to the Timeshift folder and open as root, delete all folders in it, and close file manager.
3. Run this in the Terminal:

Code: Select all

sudo apt-get purge --auto-remove timeshift

4. Then run this

Code: Select all

sudo apt-get install timeshift

5. Start Timeshift, check your settings and create a new snapshot.
See how it behaves and if you get any disk space notifications.

[YoMan]

Just to be sure, you are talking about running the 4 commands you cite in your 10:28 post??

Code: Select all

xed admin:/// /etc/systemd/journald.conf 

SystemMaxUse=50M
SystemKeepFree=100M

Make sure to remove the # in from of each one to activate it. Save and then run

sudo systemctl restart systemd-journald.service

I'm not sure how the statement regarding removal of # applies here?

[LanceM]

Yes and the section 10 in the link I left:https://easylinuxtipsproject.blogspot.c ... -mint.html

[YoMan]

OK, I thought you had repeated what was in the link but, I need to do both. Got it.
I don't understand the # removal you mention. I see that the 2nd command line in the link has a # in it. Do I remove that? Leave a space or not? I know what it means when a text file has a # at the beginning of a line but, here, I'm confused.

[LanceM]

Exactly like this:

Code: Select all

SystemMaxUse=50M
SystemKeepFree=100M

[YoMan]

Ran the two command lines in Section 10. Appears to go OK.

Code: Select all

xed admin:/// /etc/systemd/journald.conf 

responded with "The specified location is not mounted. Is this a command line?

EDIT
I think I figured it out

[LanceM]

Sorry typo. Correct is

Code: Select all

xed admin:///etc/systemd/journald.conf

Section 10. has more than two commands. There are all the optional ones as well. We are power washing your system so I think you should do them too.

[pbear]

I'll say it again. With all due respect, the logs are a symptom, not the problem.

[YoMan]

Code: Select all

xed admin:///etc/systemd/journald.conf

Ran it and got the journald.conf script file. Removed all of the # and saved it. However, I cannot figure out how to run it. I looked up "how to run a script file" and tried to follow that (seemed simple enough) but, got "can't open" message.

[LanceM]

Code: Select all

xed admin:///etc/systemd/journald.conf

Ran it and got the journald.conf script file. Removed all of the # and saved it. However, I cannot figure out how to run it. I looked up "how to run a script file" and tried to follow that (seemed simple enough) but, got "can't open" message.

When you run the command it should prompt you twice for your password. You enter that both times then it opens that file. You scroll down and find the 2 lines that say:
#SystemMaxUse=
#SystemKeepFree=
and change them to
SystemMaxUse=50M
SystemKeepFree=100M
Once you have done that you save the changes by giong up to the save button on the window bar.
Then you close it and close the Terminal.
Then reopen the Terminal and run

Code: Select all

sudo systemctl restart systemd-journald.service

[YoMan]

When you run the command it should prompt you twice for your password. You enter that both times then it opens that file. You scroll down and find the 2 lines that say:
#SystemMaxUse=
#SystemKeepFree=
and change them to
SystemMaxUse=50M
SystemKeepFree=100M
Once you have done that you save the changes by giong up to the save button on the window bar.
Then you close it and close the Terminal.
Then reopen the Terminal and run

I totally misunderstood.
The command will no longer open the file. I get the message "Set document metadata failed: Operation not supported". However, I can open it in the file manager as root. Due to my last attempt, all of the items no longer have the #. I think all lines had it to begin with. When done correctly, are the two lines
SystemMaxUse=50M
SystemKeepFree=100M
the only ones without the # ?

[trytip]

I deleted the 4 Timeshift folders.

Always delete snapshots using Timeshift. Have you not been doing that in the past? If so it might well be the problem.

i delete snapshot folders with nemo, then before i create my next timeshift i go in /var/log/ and delete every file but keep the folders. i change ppa a lot and additional repositories so i also delete every file in /var/cache/apt/
don't do as i do, but that's what i do

[LanceM]

I think all lines had it to begin with. When done correctly, are the two lines

Here's mine after doing the section 10. tips and the edit in my last post.

Code: Select all

bb
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See journald.conf(5) for details.

[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=1000
SystemMaxUse=50M
SystemKeepFree=100M
#SystemMaxFileSize=
SystemMaxFiles=7
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=yes
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K

[LanceM]

If you can get text as it should be, don't forget to run

Code: Select all

sudo systemctl restart systemd-journald.service

Reboot the PC and then try

Code: Select all

xed admin:///etc/systemd/journald.conf

to see if it will open the file.

[YoMan]

If you can get text as it should be, don't forget to run

Code: Select all

sudo systemctl restart systemd-journald.service

Reboot the PC and then try

Code: Select all

xed admin:///etc/systemd/journald.conf

to see if it will open the file.

Did all as above and the file opened as it should.

I also deleted and reinstalled Timeshift per instructions above. New snapshot is 6.7GB.