out of space on /root

[Bob]

** Reply to message from Xen <list at xenhideout.nl> on Mon, 06 Mar 2017 07:53:00
+0100

> Bob schreef op 06-03-2017 7:33:
> > Using Ubuntu 16.10.  The system ran out of space on /root.  I found 
> > that
> > /var/log/syslog was 27gb in size.  I deleted all the syslog.* files and 
> > got the
> > system sort of working and copied /var/log/syslog to my home directory 
> > (/home
> > is on a different partition than /root).  I then deleted the syslog 
> > file and
> > rebooted.  Now things are working OK.  I would like to find out what 
> > caused
> > this problem but can not look at the syslog file as it is too large.  
> > Any ideas
> > on how to display this file?
> 
> In general commands such as:
> 
> cat "file" | tail -n 500
> 
> will get you the last 500 lines.
> 
> You can make that 500 figure as large as you want.
> 
> Maybe with a file so large a better command would be
> 
> tail -n 500 "file" so that tail can do random seeks, but I'm not sure.
> 
> 
> The above command will read the entire file from disk before tail will 
> filter out the last 500 lines.
> 
> What you can easily do is to use the "split" command to first reduce it 
> into smaller bits.
> 
> The idiomatic expression:
> 
> 
> cat "file" | split -b 500M
> 
> would do the trick, although again, you can better directly name a file:
> 
> 
> split -b 500M "filename".
> 
> Both should work (tail and split with a direct filename). If you use 
> split, you will need the same amount of space you are already using.

Thanks to all that replied, that was a very interesting discussion.



After reading the man page I did a 

split -C 250M -d syslog

I thought 500M was too large and I was right.  Even at 250M the file took about
a minute to read and was very slow trying to page very far.  Now that I have
looked at the file I could have used "head -n 200" to get the start and "tail
-n 5000" to get the end.  The entire rest of the 27gb of syslog was

Mar   5 17:26:55 Jupiter nautilus-autostart.desktop[3036]:
H#033[1:1H#033[1:1H#033[1:1H#033[1:1H#033[1:1H#033[1:1H#033[1:1H#033[1:1H#033

etc, each line is a little over 3kb.  These time stamps start about 11am and
ends when the system runs out of space at about 5:30pm.

I do not know much about Ubuntu but looking at the syslog the first 133 lines
look like normal log entries.  The next 5 lines are garbage and is about 13kb
long.

So my guess is that the log entry that would show the problem has been
overlayed and I will never know what caused the problem.  I will just hope that
it does not happen again.

-- 
Robert Blair


The only difference between a tax man and a taxidermist is that the taxidermist leaves the skin.  -- Mark Twain