/var/log/messages Grows by Several GB Every Boot

English Install/Boot/Login
1

openSUSE 15.3, KDE.
New install. All partitions except /home were reformatted.
Both drives are Samsung 2.5 inch form factor 500GB SSDs, SATA 6Gb, “Crucial MX500”
Two years old drives (new in Jan 2019). I was running openSUSE 15.2 since its release and did a fresh install
of 15.3, one drive has ext4 formatted root, and the other drive has XFS formatted /home.
I had the 15.3 installer reformat root (ext4) as part of the install.

At the end of the install the Installer message about copying logs to disk took forever (10+ minutes).
/var/log was 6GB full after install.
A couple of reboots later and /var/log was 9GB full.
After about 45 minutes /var/log was 18GB full.
One shutdown, then power up cycle and root was 29GB full with /var/log being 23GB of it.
Most of the space is in /var/log/messages (13GB) and /var/log/warn (10GB).

My root partition will be filled very quickly at this rate.

Any ideas?

2

From “tail messages”

2021-07-05T09:41:56.144135-05:00 rna0128715 kernel:  2038.336794] pcieport 0000:00:1c.7: AER:   device [8086:a297] error status/mask=00000001/000020002021-07-05T09:41:56.144135-05:00 rna0128715 kernel:  2038.336794] pcieport 0000:00:1c.7: AER:     0] RxErr                 
2021-07-05T09:41:56.144136-05:00 rna0128715 kernel:  2038.336997] pcieport 0000:00:1c.7: AER: Corrected error received: 0000:00:1c.7
2021-07-05T09:41:56.144136-05:00 rna0128715 kernel:  2038.337017] pcieport 0000:00:1c.7: AER: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)
2021-07-05T09:41:56.144136-05:00 rna0128715 kernel:  2038.337018] pcieport 0000:00:1c.7: AER:   device [8086:a297] error status/mask=00000001/00002000
2021-07-05T09:41:56.144137-05:00 rna0128715 kernel:  2038.337018] pcieport 0000:00:1c.7: AER:     0] RxErr                 
2021-07-05T09:41:56.144137-05:00 rna0128715 kernel:  2038.337081] pcieport 0000:00:1c.7: AER: Corrected error received: 0000:00:1c.7
2021-07-05T09:41:56.144137-05:00 rna0128715 kernel:  2038.337084] pcieport 0000:00:1c.7: AER: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)
2021-07-05T09:41:56.144138-05:00 rna0128715 kernel:  2038.337084] pcieport 0000:00:1c.7: AER:   device [8086:a297] error status/mask=00000001/00002000
2021-07-05T09:41:56.144138-05:00 rna0128715 kernel:  2038.337085] pcieport 0000:00:1c.7: AER:     0] RxErr

over and over and over

I loaded kubuntu yesterday as a test. it does not do this. I reloaded 15.3 this morning and it started growing again.

3

@xlis:

Is the systemd service “logrotate.timer” enabled?
Does ‘/etc/logrotate.d/syslog’ include an entry for ‘/var/log/messages’?

4

My pc has an Intel Core I7-8700k @3.70Ghz and 16GB of RAM

5

Then, it’s a PCIe bus error –

  • Have you attempted to re-seat the module in the PCIe bus slot?
  • Are the module’s contacts clean and not damaged?
  • Is the PCIe slot clean and not damaged?
6 
**rna0128715:/home/larry #** systemctl status logrotate.timer
**●** logrotate.timer - Daily rotation of log files
     Loaded: loaded (/usr/lib/systemd/system/logrotate.timer; enabled; vendor preset: enabled)
     Active: **active (waiting)** since Mon 2021-07-05 09:08:02 CDT; 46min ago
    Trigger: Tue 2021-07-06 00:00:00 CDT; 14h left
   Triggers: ● logrotate.service
       Docs: man:logrotate(8)
             man:logrotate.conf(5)

Notice: journal has been rotated since unit was started, output may be incomplete.



**rna0128715:/home/larry #** cat /etc/logrotate.d/syslog
#
# Please note, that changing of log file permissions in this
# file is not sufficient if syslog-ng is used as log daemon.
#
# It is required to specify the permissions in the syslog-ng
# configuration file /etc/syslog-ng/syslog-ng.conf as well.
#

# the firewall,acpid,NetworkManager log files
# are used by syslog-ng and rsyslog only, the
# other by all syslog daemons.
# the mail log files are used by all syslog daemons
# the news log files are used by all syslog daemons
/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages
/var/log/firewall /var/log/acpid /var/log/NetworkManager
/var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err
/var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice
{
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    sharedscripts
    postrotate
        /usr/bin/systemctl reload syslog.service > /dev/null
    endscript
}
7

Hi
So what device is present in Corrected error received: 0000:00:1c.7?


/sbin/lspci -nnk | egrep -A2 "00:1c"
8

Not sure. This pc has never been opened except to blow out dust every 6 months or so.
It has never been moved.

There is just one card visible on the back. that card has 2 RCA coax cable jacks (like for cable tv).
nothing plugged in to it.

So everything else must be plugged in internally.

I will shut it down, remove both side panels, and take a look…

9

Hi
Might be worth a read: https://gist.github.com/Brainiarc7/3179144393747f35e5155fdbfd675554

Or suppress via add the following to kernel boot options via YaST bootloader;


pci=noaer
10

A decent

sudo lspci -v -s 00:1c.7

should give you the relevant info on the PCI device, I guess…

11

OK, the one and only expansion card was a wireless card that has never been used.
The “connectors” on the back were to screw in the 2 wireless antennas.

I removed that card. All other slots are empty. Most everything is built in to the motherboard.

My office is fully wired for 1 Gbs ethernet.

I reset the 4 memory DIMMs.

Nothing resolved the issue.

So I marked that computer for recycle and bought a new one.

The new pc has windows preinstalled on a 1 TB nvm.

I added a new 2.5 inch 2 TB samsung SSD for linux

I installed 15.3 on the 2 TB drive.

Everything works as expected (Windows and Linux).

Yeah, I know…but I use Windows every March to do my taxes with TurboTax.

The rest of the year I use Linux.

Thanks for everyone’s help.