is it safe to delete var/log files

MsMattie · 2017-01-30 03:55:04

I'm in need of some help while traveling. I've been sorting and cataloging raw photos using nautilus which shows thumbnails of raw camera files. It works better than thunar for that. As a result of this, I think, I am running out of disk space. The problem I found using baobab. In the var/log folder where there are several too large files - daemon.log, syslog, and daemon.log.1 - all three taking up about 8GB of space.

What I want to do is delete those three files. I assume upon next start-up they will be recreated and I will have 8GB of space back. Is this safe to do?

In googling about there are methods of taking care of this automatically. Which I can try when I get back to a safe place to do that. But for now I am shooting photo and video work in the Third World with no second laptop if I screw this one up. So, I would prefer to just safely delete those files, if that will work. Is it safe to delete those files which I can do with $ sudo thunar and then do the deletion?

Head_on_a_Stick · 2017-01-30 07:35:04

MsMattie wrote:

Is it safe to delete those files

Yes, as long as your system has no problems then you have no need of any old log files at all.

I would recommend using the command line rather than thunar but I suppose that is more a matter of preference.

However, use this to start it:

gksudo thunar

Using full `sudo` confers too many privileges and should not be used for graphical applications.

To manage your logs in the future, I would actually recommend disabling all of the old-fashioned syslog tools and to add your user to the systemd-journal group and use that instead — the systemd journal is already active anyway and offers better filtering capabilities so there seems little point in leaving the "legacy" logging system running.

If you want to try this, post back with the output of:

systemctl list-unit-files | grep enabled

so we can see what needs to be disabled.

Allow your normal user to view the systemd journal with:

sudo gpasswd -a $USER systemd-journal

Tricks & tips for `journalctl` here:

https://www.digitalocean.com/community/ … stemd-logs

If you want to stick with the traditional logging methods then read

man logrotate

ohnonot · 2017-01-30 07:46:08

i recently got fed up with looking at all those archived old logs in /var/log and simply deleted everything with a .gz extension.
have not felt any adverse effect yet.
that was months ago, they have accumulated again since.
but i'm sure there's a programmatic way to limit that.

MsMattie · 2017-01-30 12:33:51

Thanks much for the help.

Here is the result of $ systemctl list-unit-files | grep enabled

X200s:~$ systemctl list-unit-files | grep enabled
cups.path                                  enabled 
anacron-resume.service                     enabled 
anacron.service                            enabled 
avahi-daemon.service                       enabled 
binfmt-support.service                     enabled 
cron.service                               enabled 
cups-browsed.service                       enabled 
cups.service                               enabled 
dbus-org.freedesktop.Avahi.service         enabled 
dbus-org.freedesktop.ModemManager1.service enabled 
dbus-org.freedesktop.nm-dispatcher.service enabled 
display-manager.service                    enabled 
getty@.service                             enabled 
hwclock-save.service                       enabled 
lightdm.service                            enabled 
lm-sensors.service                         enabled 
ModemManager.service                       enabled 
NetworkManager-dispatcher.service          enabled 
NetworkManager.service                     enabled 
openvpn.service                            enabled 
rsyslog.service                            enabled 
smartd.service                             enabled 
syslog.service                             enabled 
tor.service                                enabled 
avahi-daemon.socket                        enabled 
cups.socket                                enabled 
uuidd.socket                               enabled 
remote-fs.target                           enabled

MsMattie · 2017-01-30 12:51:35

And I just did delete those big log files.

Then fired up the little laptop again and everything boots up fine with the extra disk space now available.

So, thanks again...

Head_on_a_Stick · 2017-01-30 19:07:24

MsMattie wrote:

Here is the result of $ systemctl list-unit-files | grep enabled

OK, to disable the traditional syslog mechanism, run these commands:

sudo systemctl disable {r,}syslog
sudo systemctl stop {r,}syslog

This will stop any further log files accumulating.

If you decide to turn it all back on again, use:

sudo systemctl enable {r,}syslog
sudo systemctl start {r,}syslog

The systemd journal (that you will use instead of syslog) defaults to an "auto" setting in respect of storage of old journal contents, this means that they are not saved to disk at all unless a folder at /var/log/journal is created.

If that folder is present, journal logs will be stored according to the (commented-out) defaults listed in /etc/systemd/journald.conf — the size of the files can be controlled from there, just remove the "#" symbol at the start of the line and change according to taste

For more on this, read

man journald.conf

Last edited by Head_on_a_Stick (2017-01-30 19:09:24)

MsMattie · 2017-01-31 00:26:39

OK, I did this and it all works great.

This forum and Head_on_a_Stick was very helpful while on the road and having to get things straightened out with only one machine available.

So thanks again for the help.

As a side note, one other thing that could have been causing these huge logs was FreeFileSync which I have been using to backup thousands of photos and video files from one external hard drive to another. This probably creates huge logs in the process, and that may have been where these were coming from.

ohnonot · 2017-01-31 09:28:40

another place where cruft (in large amounts) accumulates is ~/.cache - esp. left behind by apps that have been uninstalled since or aren't in use.
except chrom(e/ium), whose cache is in ~/.config...

some member of these forums came up with this monster:

du -ak -x "$@" | sort -n | tail -21 | \
awk -F '\t' -v OFS='\t' '{if ($1 > 1048576) $1 = sprintf("%.1fG",$1/1048576); else if ($1 > 1024) $1 = sprintf("%.1fM",$1/1024); else $1 = sprintf("%sK",$1)} 1'\
| sed 's/\t\.\//\t/g' | head -20

it will tell you about where the most stuff is on your hard drive, in a humanly readable way.

Head_on_a_Stick · 2017-01-31 09:37:57

MsMattie wrote:

As a side note, one other thing that could have been causing these huge logs was FreeFileSync which I have been using to backup thousands of photos and video files from one external hard drive to another. This probably creates huge logs in the process, and that may have been where these were coming from.

This is a very good point — determining the source of the errors is a much better approach than simply ignoring them.

It may be worth checking the output of:

journalctl

To see if there are any obvious errors, they should be marked out in red (I think).

Upload the output to https://paste.debian.net/ and post the URL (link) here if you see anything untoward

#1 2017-01-30 03:55:04

is it safe to delete var/log files

#2 2017-01-30 07:35:04

Re: is it safe to delete var/log files

#3 2017-01-30 07:46:08

Re: is it safe to delete var/log files

#4 2017-01-30 12:33:51

Re: is it safe to delete var/log files

#5 2017-01-30 12:51:35

Re: is it safe to delete var/log files

#6 2017-01-30 19:07:24

Re: is it safe to delete var/log files

#7 2017-01-31 00:26:39

Re: is it safe to delete var/log files

#8 2017-01-31 09:28:40

Re: is it safe to delete var/log files

#9 2017-01-31 09:37:57

Re: is it safe to delete var/log files

Board footer