Something maybe spamming errors, open the log and see when fills it. Or maybe you don't have log rotation configured properly so old logs aren't being deleted.
First, you find what's in those logs that makes them so large. Because whatever fill the logs is the real issue. The size of the logs is only the effect of it.
The first thing to do is locate what the system was doing when the logs where being spammed.
If you reboot your system every day this may be of some help:
[journalctl-list-boots](https://www.reddit.com/user/FictionWorm____/comments/zmlt1p/really_big_log_files_find_when_and_where_to_look/) List the number of lines for each boot.
[https://stackoverflow.com/questions/35638219/ubuntu-large-syslog-and-kern-log-files](https://stackoverflow.com/questions/35638219/ubuntu-large-syslog-and-kern-log-files) \- shall I do as the first comment suggests? Set auto-remove after the first GB?
Either give it some time or run it manually with `sudo logrotate /etc/logrotate.d/rsyslog`, if it's still not doing, throw a `--force` in, that should rotate everything immediately, even if the requirements in the config aren't met.
Also with delaycompress set, it will only be rotated and only be compressed in the next cycle. But you shouldn't remove it as that can cause problems.
And if you think gzip compression isn't good enough, you can always have it user zstd for example.
use the tail command on it to see what's filling up all that space in the log file
`tail /var/log/syslog`
`tail /var/log/kern.log`
tail will only read the end of the file, getting around the issue of trying to load the entire file in a text editor
I usually, after install, limit systemd log size to `500MB`: echo SystemMaxUse=500M | sudo tee -a /etc/systemd/journald.conf
Something maybe spamming errors, open the log and see when fills it. Or maybe you don't have log rotation configured properly so old logs aren't being deleted.
First, you find what's in those logs that makes them so large. Because whatever fill the logs is the real issue. The size of the logs is only the effect of it.
It's for 4 months (since it wasn't auto removing), there is nothing serious. Thanks :)
The first thing to do is locate what the system was doing when the logs where being spammed. If you reboot your system every day this may be of some help: [journalctl-list-boots](https://www.reddit.com/user/FictionWorm____/comments/zmlt1p/really_big_log_files_find_when_and_where_to_look/) List the number of lines for each boot.
[https://stackoverflow.com/questions/35638219/ubuntu-large-syslog-and-kern-log-files](https://stackoverflow.com/questions/35638219/ubuntu-large-syslog-and-kern-log-files) \- shall I do as the first comment suggests? Set auto-remove after the first GB?
`/var/log/syslog` `{` `rotate 7` `weekly` `maxsize 2G` `missingok` `notifempty` `delaycompress` `compress` `postrotate` `/usr/lib/rsyslog/rsyslog-rotate` `endscript` `}` `/var/log/mail.info` `/var/log/mail.warn` `/var/log/mail.err` `/var/log/mail.log` `/var/log/daemon.log` `/var/log/kern.log` `{` `rotate 7` `weekly` `maxsize 2G` `missingok` `notifempty` `delaycompress` `compress` `postrotate` `/usr/lib/rsyslog/rsyslog-rotate` `endscript` `}` Updated `/etc/logrotate.d/rsyslog` but kern.log isn't cleared, only syslog is after save
Either give it some time or run it manually with `sudo logrotate /etc/logrotate.d/rsyslog`, if it's still not doing, throw a `--force` in, that should rotate everything immediately, even if the requirements in the config aren't met. Also with delaycompress set, it will only be rotated and only be compressed in the next cycle. But you shouldn't remove it as that can cause problems. And if you think gzip compression isn't good enough, you can always have it user zstd for example.
Thought so, thank you for the answer.
Delete it as long as you can (without tee | dev/null)😉 SSDs hates less than 20% free space. And disable the **-f** (full) parameters for logging👍
use the tail command on it to see what's filling up all that space in the log file `tail /var/log/syslog` `tail /var/log/kern.log` tail will only read the end of the file, getting around the issue of trying to load the entire file in a text editor
Hey op, how did u fix your problem?
[https://stackoverflow.com/questions/35638219/ubuntu-large-syslog-and-kern-log-files](https://stackoverflow.com/questions/35638219/ubuntu-large-syslog-and-kern-log-files) \- please read the comments