Which files to delete in root?

Linuxinlennox · January 26, 2011, 12:21am

Hi All! After my system would not boot to user i could only access root and got the message
The volume “filesystems root” has 0 disk space remaining. Free up space by removing unused files or or move to another disk partition.
I have seen this before in my home partition and i just deleted and moved the files to solve the problem.
In this case, looking at the disk usage analyser in root, i could see the critical area (red zone) was in the root in a directory folder called ‘log’ within a folder called ‘var’. This area is out of my depth. I need to know what is deletable in this folder? There are many text files with error messages, warnings, info and logs there. they appear to have been directed there and have reached a critical mass. Are they safe to delete? There are a couple of text/plain files that are massive (50.7 GB) one titled messages-20101027, there are some more of similar size. Can i trash these?
Sorry if this sounds too simple. Way out of my depth here in root.

Thank you

gogalthorp · January 26, 2011, 2:00am

Most like you have filed up your logs. The du and df commands may help locate the over sized files.

Check /tmp large files can accumulate there

LewsTherinTelemon · January 26, 2011, 2:12am

Hi there,

While Gogalthorp is correct as far as using the du and df commands, it did not really answer your question about what specifically you can delete in /var - basically, you can pretty much delete everything in /var/log - they are just log files, and unless you plan you use the to debug an issue, there is about a 99% chance you don’t actually need anything in there. More specifically, if you have a bunch of files titled messages-* then these can be deleted. However, an inquiring mind might want to examine some of them. These are kernel messages, and if you have a lot of files of this type then you are getting tons of messages logged - so the question is how come? Perhaps they are dhcp messages, or messages about a failing hard drive, or the price of cheese on the moon - but you might want to look.

Another quick fix - just move the contents of /var/log to /home/oldlogs - this lets you free up space on / instantly and yet keep the old logs so you can examine them.

Cheers,
Lews Therin

please_try_again · January 26, 2011, 2:23am

These files are normally safe to delete - they don’t grow that much though.
Example:

agnelo@uhura:~> ls /var/log/{*.log,*.bz2,messages*}
/var/log/auth.log               /var/log/nscd.log           /var/log/wtmp-20101211.bz2  /var/log/Xorg.4.log
/var/log/boot.log               /var/log/nxserver.log       /var/log/xdm.log            /var/log/Xorg.5.log
/var/log/cron.log               /var/log/pm-powersave.log   /var/log/xinetd.log         /var/log/zypper.log
/var/log/daemon.log             /var/log/rsyncd.log         /var/log/Xorg.0.log         /var/log/zypper.log-20101025.bz2
/var/log/messages               /var/log/vbox-install.log   /var/log/Xorg.1.log         /var/log/zypper.log-20101120.bz2
/var/log/messages-20110110.bz2  /var/log/wtmp-20100907.bz2  /var/log/Xorg.2.log         /var/log/zypper.log-20101223.bz2
/var/log/messages-20110110.bz2  /var/log/wtmp-20101001.bz2  /var/log/Xorg.3.log

venzkep · January 26, 2011, 3:16am

On Tue January 25 2011 07:06 pm, gogalthorp wrote:

>
> Most like you have filed up your logs. The du and df commands may help
> locate the over sized files.
>
> Check /tmp large files can accumulate there
>
Linuxinlennox;

If /tmp is the problem or could be the problem. This HowTo should help.

http://forums.opensuse.org/english/get-technical-help-here/how-faq-forums/unreviewed-how-faq/412640-clear-temp-files-boot.html

–
P. V.
“We’re all in this together, I’m pulling for you.” Red Green

Linuxinlennox · January 26, 2011, 12:10pm

Thank you everyone. That fixed the problem. I will keep check on the folder and if accumulation gets out of hand in future I will look into it.
Thank you please_try_again for that list, it was very useful.
Thank you also to venzkep for the link and LewsTherinTelemon for the advice.
cheers

DenverD · January 26, 2011, 12:45pm

On 01/26/2011 12:36 AM, Linuxinlennox wrote:
>
> Hi All! After my system would not boot to user i could only access root
> and got the message
> -The volume “filesystems root” has 0 disk space remaining. Free up
> space by removing unused files or or move to another disk partition.-
> I have seen this before in my home partition and i just deleted and
> moved the files to solve the problem.
> In this case, looking at the disk usage analyser in root, i could see
> the critical area (red zone) was in the root in a directory folder
> called ‘log’ within a folder called ‘var’. This area is out of my depth.
> I need to know what is deletable in this folder? There are many text
> files with error messages, warnings, info and logs there. they appear to
> have been directed there and have reached a critical mass. Are they safe
> to delete? There are a couple of text/plain files that are massive (50.7
> GB) one titled -messages-20101027-, there are some more of similar
> size. Can i trash these?
> Sorry if this sounds too simple. Way out of my depth here in root.
>
> Thank you
>
>
the others have address how to manage space in /var and /tmp but i
think it is important to realize that those areas being so bloated is
not the problem, but rather a symptom of the problem…

when you could no longer log in as yourself that was a symptom of
the problem (disk almost full), you did NOT fix that problem by
beginning to log in as root, instead you avoided the symptom of the
too full problem by beginning to fill the 5% of space reserved only
for root…

reserved so you could, as root, fix the too full problem…

but you didn’t do that, instead with the symptom of the problem out of
site you assumed the problem was gone…but, as you see it was not…

[please don’t take this a saying you did bad, instead i know it is
simply because you didn’t know–and THAT is why i write…it is up to
you to stick with it and learn…]

now, you can attack the apparent problem (reduce drive space used) in
several ways:

add drives and allow them to fill up with out of control logs
empty /var and let it fill up again with out of control logs

or, you can realize that huge logs is not the problem, instead it is
the symptom of the problem…there are several ways to do that:

or just change logrotate so the logs are dumped in the waste more
often (or rolled up into smaller archive files more often) and you
will have again hidden a symptom
what is filling your log? find that (those?) problem(s?) and solve
it (them)…

the choice is yours, find and solve the problem(s) or just continue to
deal with the symptoms the problems cause…

–
DenverD
CAVEAT: http://is.gd/bpoMD [posted via NNTP w/openSUSE 11.3, KDE4.4.4
release 3, Thunderbird3.0.11,]
“It is far easier to read, understand and follow the instructions than
to undo the problems caused by not.” DD 23 Jan 11

robin_listas · January 26, 2011, 11:33pm

On 2011-01-26 00:36, Linuxinlennox wrote:

> In this case, looking at the disk usage analyser in root, i could see
> the critical area (red zone) was in the root in a directory folder
> called ‘log’ within a folder called ‘var’. This area is out of my depth.
> I need to know what is deletable in this folder? There are many text
> files with error messages, warnings, info and logs there. they appear to
> have been directed there and have reached a critical mass. Are they safe
> to delete? There are a couple of text/plain files that are massive (50.7
> GB) one titled -messages-20101027-, there are some more of similar
> size. Can i trash these?

Not before you find out why they filled out so much.

As Denver says, that’s just the symptom, not the cause of the problem. The
messages file is so big because it is being filled by millions of the same
(I bet you) message line. Display the file with “less” in a terminal (do
not use an editor), find out what is that text, and report back here.

Or, search the forum, this exact problem has been reported previously.

–
Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” at Telcontar)

hermanab · January 27, 2011, 8:40am

Howdy,

When you install a new service, you should always check /etc/logrotate.conf to ensure that all the log files are handled. Obviously, yours is missing a few, so they just keep growing and growing…

NonZ · February 11, 2011, 9:38am

rotfl! I’d love to see an editor handle a 50G file! I think even gvim would choke on that!

We need a program that scans log files for repetitive sequences of messages. The 50G file could then be consolidated – to a 1K message sequence followed by a very large repetition factor.

robin_listas · February 11, 2011, 3:50pm

On 2011-02-11 10:06, NonZ wrote:
>
> robin_listas;2282825 Wrote:
>> Display the file with “less” in a terminal (do
>> not use an editor), find out what is that text, and report back here.
>
> rotfl! I’d love to see an editor handle a 50G file! I think even gvim
> would choke on that!

With some editors you’d need as much temporary disk space to do it. I’ve
never tried such a big file. About one or two gigs, yes.

> We need a program that scans log files for repetitive sequences of
> messages. The 50G file could then be consolidated – to a 1K message
> sequence followed by a very large repetition factor.

Scan → eyes

My guess is that the repetitive section will be huge and easy to find,
manually.

–
Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” at Telcontar)

djh-novell · February 11, 2011, 4:04pm

Carlos E. R. wrote:
> On 2011-02-11 10:06, NonZ wrote:
>> We need a program that scans log files for repetitive sequences of
>> messages. The 50G file could then be consolidated – to a 1K message
>> sequence followed by a very large repetition factor.
>
> Scan → eyes

syslog will do this already AFAIK. At least, I see something similar to
“repeated message x times” on some systems. Don’t know why it’s only on
some systems though.

robin_listas · February 11, 2011, 4:20pm

On 2011-02-11 16:04, Dave Howorth wrote:
> Carlos E. R. wrote:

> syslog will do this already AFAIK. At least, I see something similar to
> “repeated message x times” on some systems. Don’t know why it’s only on
> some systems though.

Because in suse’s rsyslog you need to configure for it. It was left off on
purpose for debugging during factory testing, and not changed on GM.

There is a bugzilla about this.

Add this setting:

$RepeatedMsgReduction on

–
Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” at Telcontar)

djh-novell · February 11, 2011, 5:02pm

Carlos E. R. wrote:
> Because in suse’s rsyslog you need to configure for it. It was left off on
> purpose for debugging during factory testing, and not changed on GM.
>
> There is a bugzilla about this.
>
> Add this setting:
>
> $RepeatedMsgReduction on

Many thanks