Log file eating up whole space in Ubuntu 16.04 LTS. Fix?

Question

I have recently got into Linux and it's dual booted in my pc with windows 10. I installed a few files in Ubuntu 16.04 and a space of 41 GB is allotted for Ubuntu in my pc. But all of a sudden a prompt came up that I don't have much space remaining. After some looking, I found it's eaten mostly by the log files, more specifically the "syslog.1" file. I am pretty sure there's a mess in my apps and it's logging those problems repeatedly. I will remove most of the apps and start again.

But for now, how do I clean this file and free the 37 GB space that it has been eating up? Will this help? I found this on a forum.

sudo gzip syslog.1

Update:

The above code has worked by compressing the 37 GB log file to about 800 MB. However, I am looking for a permanent solution to find the errors causing the log file to enlarge. I have also installed a lot of .deb files. And they have a lot of unmet dependencies which need to be downloaded. How do I revert this action and remove the files which have unmet dependencies?

I have also tried:

sudo apt-get autoremove
sudo apt-get clean

These don't seem to work.

Solution

A 37GB log file is a problem in itself, especially if the system is only days old. You have to monitor the log file to see what's going on. Best is to delete the old file, as it's too big to handle. Then you can install logrotate. With it you can clean up logfiles. It can "rotate" log files daily, weekly or whatever you want. In your case it should be daily. Then you specify how many logfiles you want to keep, plus you need to zip the old ones.

That 37GB file is zipped only 4GB, so will cause no problems even if you have to keep five of them. That would still be extreme, but this is just to give you an idea of what logrotation can do.

Below you can see my logrotate config for Apache, with compression and delayed compression. It keeps the logs for 14 days. For your log you should google what a good configuration is.

/var/log/apache2/*.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        notifempty
        create 640 root adm
        sharedscripts
        postrotate
                if /etc/init.d/apache2 status > /dev/null ; then \
                    /etc/init.d/apache2 reload > /dev/null; \
                fi;
        endscript
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi; \
        endscript
}

When all is working well, you can set the logrotation back to 30 days or something.

Oh and if this is not the system you use daily, run the logrotate job manually. If the cronjob is set to run at 3 in the morning, it will probably not run, and your problem will continue to exist.

Update

You need to add compress to your logrotate config. You can add this to all configs in /etc/logrotate.d. For logs that are too big now, delete them or compress them like you did. 800MB is still too much considering you will never do anything with it, so delete it: sudo rm syslog.1.gz, and delete anything that is too big.

Comments

[Parto]

(Comment not answer) What I would do: Delete the old log file, create a new empty one then use my machine as I tail it for any errors. That will at-least help you find the cause.

[Rinzwind]

do you have gzip installed? if not that might be an issue too: "syslog.1" means uncompressed. It should have been "syslog.1.gz". And yes: that command will free up roughly 90% of the 37Gb. Also: do have a look inside the file to what is noted there. Fixing the problem is important too don't just fix the symptom ;)

[twodee]

I guess I have gzip installed because the command which I mentioned worked and compressed the file. And I think gedit will crash or something if I open this big log file. @Rinzwind

[Katu]

You can fix your problem with dependencies with sudo apt-get -f install or if you want to remove individual packages manually, use sudo dpkg --remove packagename

[twodee]

I almost forgot. Thanks @Rinzwind! I am new to linux. @Katu txakurra how do I remove them all?

[SPRBRN]

See my answer. You need to add compress to your logrotate config. You can add this to all configs in /etc/logrotate.d. For logs that are too big now, delete them or compress them like you did. 800MB is still too much considering you will never do anything with it, so delete it: sudo rm syslog.1.gz, and delete anything that is too big.

[Jos]

I believe logrotate is already installed by default on Ubuntu 16.04; /var/log/syslog is handled by the configuration item rsyslog in /etc/logrotate.d. It rotates daily and creates 7 zipped files.

[Rinzwind]

syslog.1 probably means it is log rotating. Just not zipping the log file.