# /var/log/messages is nearly 60 Gigs!!! [solved]

## jxn

my /var/log/messages file is approximately 54 GB!  It seems to me that is way too large (75% of my HD!), but it's so huge that I can't open it to see what's in it.  I'm worried that there might be some kind of bad hack/etc causing this, so I'm not really sure what to do at all.  Should I try some other method to open it?  should I just rm it?  is this some kind of bug with something?

----------

## kashani

I'd start with a tail -f /var/log/messages and see what's being written to it. If it's not growing I'd delete it and keep an eye on things for the next week or so.

kashani

----------

## spyder

logrotate for the win.

----------

## jxn

holy crap, it's growing tens of MB by the second!  I can't really tell what it's spitting out... I catch this kind of stuff blazing past the term:

```
Jan 23 23:50:35 halogen [<c0117f09>] __wake_up+0x40/0x56

Jan 23 23:50:35 halogen [<c0115a6b>] activate_task+0x93/0xa7

Jan 23 23:50:35 halogen [<c011636f>] try_to_wake_up+0x2a8/0x365

Jan 23 23:50:35 halogen [<c030a371>] scsi_cmd_ioctl+0x9a/0x50d

Jan 23 23:50:35 halogen [<c017265e>] send_sigio+0x6d/0xdf

Jan 23 23:50:35 halogen [<c0300f73>] dma_pool_alloc+0x8a/0x166

Jan 23 23:50:35 halogen [<c0172932>] __kill_fasync+0x43/0x64

Jan 23 23:50:35 halogen [<c01729a0>] kill_fasync+0x4d/0x69

Jan 23 23:50:35 halogen [<c0117f09>] __wake_up+0x40/0x56

Jan 23 23:50:35 halogen [<c037c449>] uhci_alloc_qh+0x22/0x5d

Jan 23 23:50:35 halogen [<c0362fe6>] cdrom_ioctl+0xb72/0xe1b

Jan 23 23:50:35 halogen [<c01445d8>] buffered_rmqueue+0x121/0x21f

Jan 23 23:50:35 halogen [<c0144a6b>] __alloc_pages+0x2c6/0x41c

```

any idea what to do?  I'm nearly out of disk space!

----------

## jxn

welp, I think I found the problem....

I was ripping CDs with sound-juicer, and when the CD stopped ripping, the messages quit getting spit into tail.  Apparently this was some type of a hald/ivman issue, but perhaps that's why that stuff has experimental keywords.  oops.  :Embarassed:    Anyway, I think it might have been related to the fact that I had upgraded ivman and hal and hadn't restarted them yet with sound-juicer... or something similar, because I rebooted and after that, CDs are ripping fine without dumping all that output into /var/log/messages

 :Embarassed: 

----------

## jxn

Okay, I've run into another problem caused by my own idiocy.  while trying to sort through the rubbish of the massive /var/log/messages file, I accidentally mv'd something on top of it.  Now I can't get to the file (because I've essentially copied something in its place), but gtkdiskfree still shows that 95% of my HD is taken up.  I could really care less if I lost all that worthless log data, but I would really like to recover my disk space.  Any idea what I can do?

----------

## MrUlterior

 *jxn wrote:*   

> Okay, I've run into another problem caused by my own idiocy.  while trying to sort through the rubbish of the massive /var/log/messages file, I accidentally mv'd something on top of it.  Now I can't get to the file (because I've essentially copied something in its place), but gtkdiskfree still shows that 95% of my HD is taken up.  I could really care less if I lost all that worthless log data, but I would really like to recover my disk space.  Any idea what I can do?

 

How on earth did you do that?

----------

## cyb0rg51

i had a problem like this once, something with X server would get stuck in a loop and spit out error messages, it made a .(somthing)_log 60GiG in size, I just simply removed it, updated X server and it never did it again.

----------

## Genone

Just restarting your logger should fix this (the space won't be freed if the file is still opened).

----------

## jxn

 *MrUlterior wrote:*   

>  *jxn wrote:*   Okay, I've run into another problem caused by my own idiocy.  while trying to sort through the rubbish of the massive /var/log/messages file, I accidentally mv'd something on top of it.  Now I can't get to the file (because I've essentially copied something in its place), but gtkdiskfree still shows that 95% of my HD is taken up.  I could really care less if I lost all that worthless log data, but I would really like to recover my disk space.  Any idea what I can do? 
> 
> How on earth did you do that?

 

I thought I'd try being sneaky and move the /var/log/message file (I named it /var/log/message_backup) to see if the sytem would create a new /var/log/message file... well, it didn't... so I created one without tweaking permissions or anything, and even when messages got sent, they weren't printed.  Satisfied that I'd had my fun screwing around and not accomplished anything, I decided to move the old /var/log/message_backup file back onto the new one I'd made, but I slipped doing tab completion, and before I'd realized I'd hit enter, I'd copied the black /var/log/message file onto my backup.  So, the file's no longer there, but, like I said, gtkdiskfree still says my HD is well over 90% used (it's not, it's really like 20%).  Any idea what to do about it to get my disk space back?    :Embarassed: 

----------

## Dr_Stein

I'd reboot the machine. Chances are you have some crap that is still trying to write to the logfile but is unable to. Apache does stuff like that.

Yeah, it's the "Windows Solution" but sometimes it's the quickest one. Reboot the box and then keep a close eye on the logfiles.

And install & use "logrotate"  :Smile: 

----------

## jxn

 *Dr_Stein wrote:*   

> I'd reboot the machine. Chances are you have some crap that is still trying to write to the logfile but is unable to. Apache does stuff like that.
> 
> Yeah, it's the "Windows Solution" but sometimes it's the quickest one. Reboot the box and then keep a close eye on the logfiles.
> 
> And install & use "logrotate" 

 

yeah, rebooting worked, but for some reason it took two reboots.   I'm not sure what the deal was, but don't tell any windows fanboys   :Wink:  .

----------

## MrUlterior

The correct method to get syslog-ng to recreate /var/log/messages after you delete or rename the file is to kill -HUP the process or run /etc/init.d/syslog-ng restart

----------

## Dr_Stein

 *MrUlterior wrote:*   

> The correct method to get syslog-ng to recreate /var/log/messages after you delete or rename the file is to kill -HUP the process or run /etc/init.d/syslog-ng restart

 

That was mentioned before and seemingly, didn't work out for him.  :Sad: 

----------

## Bobnoxous

I realize this problem has been solved, but I wanted to add my experience. When ripping CDs using grip, my log file would fill up with error messages generated by grip. I forget the error, but I think it's a problem with the CDROM driver in later kernels. Generally harmless, but it does waste lots of space.

Since I somehow did not have logrotate installed and running, the /var/log/messages file grew until it consumed my whole partition. I had to delete the log file to be able to install logrotate. I changed the logrotate frequency to be every day, since I was still ripping CDs and the file would become a few gig after a dozen CDs or so. 

Now that I'm done ripping CDs, I should probably back the logrotate frequency down to every week.

----------

## jxn

Thanks for all the ideas/help, y'all.  It's interesting that this problem has shown up with sound-juicer but also with grip which (I don't believe) uses dbus/hal/etc in the same way that sound-juicer does...  It seemed to me to be something with one of those two though it could be kernel related (I just upgraded after this fiasco to gentoo-sources-2.6.15-r1), but I have no real record of it or its causes now because I haven't been able to reproduce it since my last reboot.  Hopefully it won't pop up again... I've got tens of thousands more CDs to rip (this machine is for the radio station i work at).  Regardless, I've installed logrotate, and I'm about to config it now.

thanks again!

----------

## Falador

 *Quote:*   

> I had to delete the log file to be able to install logrotate

 

This is why I always have a separate partition for /var/log, A similar problem brought my system to it's knees a few years ago. Never again   :Smile: 

----------

## Bobnoxous

Oh, that's why everyone says to put /var on a separate partition!! I finally get it.

----------

