Huge log files on fairly new install

[newb85]

Nope.
logrotate.d is a directory with config files for specific logs. I don't have one for syslog. The section you showed is absent from my logrotate.conf file, too.

[pmi2]

Nope.
logrotate.d is a directory with config files for specific logs. I don't have one for syslog. The section you showed is absent from my logrotate.conf file, too.

Yes, sorry. Too much cut and paste, too little actual thinking on my part...

this file: /etc/logrotate.d/rsyslog

I have two sections, the first is what I posted above, the second covers other logs.

/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}

[newb85]

Oh, you're right, pmi2. When I scanned the contents of logrotate.d visually, I overlooked rsyslog. It is exactly as you say. It makes sense, now.

[newb85]

...but I just found something that doesn't. The current syslog file is only 21MB, but it still contains scores of the offending entries from Feb 22. That was 3 days ago. It also has quite a few entries from the 23rd. Why would those entries appear in syslog, and not one of the archived files? Perhaps it had something to do with how large syslog was?

[pmi2]

1) I don't know why there are multiple dates in your log files, but that may be a separate issue.

2) Your log files are still very large. Unless you are doing something very elaborate with your system, and you know why they are filling up (besides mei-me), I would try to get this sorted. Really.

3) There are a lot of posts regarding multiple mei-me messages, and mei-me spamming the logs, not just in Ubuntu, but other distros also. There seem to be more on Euro web sites, and some (OK most) are over my head. I did NOT see a perfect solution, just workarounds, and no single workaround or patch. I think you have some options to try, but not a single solution guaranteed to work.

MEI is also called "Intel Management Engine Interface". You can try to disable MEI in the BIOS. There are some references on how to do that, and it seems to solve some of the issues, but not all.

It looks like mei and mei-me are kernel modules that you have (some) control over. I can remove them from my system without breaking stuff, but there is no telling about yours.

You can try to blacklist the module, but if something else calls for it, it may load anyway, so that may be an exercise in futility.

I think you can remove this module safely using rmmod, or modprobe -r

rmmod [-w] [-v] [modulename]

(-w for wait until module is not active, and -v for verbose so you can see what you are doing)

example:

sudo rmmod -w -v mei-me

If you go this route (removing the module), you should probably run lsmod before and after, to make sure it is really gone, and then check the log for the messages. If they are gone, you can look into removing the module automatically immediately on boot.

If you find a solution that works, please post it for others, I bet this is causing a few more people headaches, and should probably be dealt with by someone above my paygrade...

[newb85]

I don't know that I'm doing anything elaborate. I run virtualbox on my system to do some testing. I have a few extra packages installed.

I can't seem to find anything in the BIOS about disabling Intel Management Engine Interface.

My current syslog (which apparently hasn't been rotated since the 23rd?) comes in at 21 MB, but if I strip it of all mei_me entries, it's a mere 729kB. Is that alarming?

[pmi2]

Less than 1 MB size in the current syslog is not alarming. Mine reaches around 3~400K before is is compressed and archived, and less than 100K after (the .gz files). I would examine what is left for other unexpected error messages.

Here is a link to a post by someone who disabled it in his BIOS, but I have seen other comments from people who tried the same fix unsuccessfully. In any case it is not really a fix (having to disable part of your BIOS is a kludge, not a fix) there are posts elsewhere from people whose system is basically locked up by a similar error, and some may just give up.

http://askubuntu.com/questions/56132...amming-logfile

The answer for why the log is not being rotated may be in the .conf file, or in /etc/logrotate.d/rsyslog. Rotate has a lot of options, so you may have to examine those line by line.

[pmi2]

... I can't seem to find anything in the BIOS about disabling Intel Management Engine Interface. ...

Just to cover all bases, and for anyone else reading, on my older Intel mobo the ME options are not accessible from the System BIOS, so in that case, pressing <F2> on boot would take you to the wrong place.

I have to press <ctrl><P> to access the "Intel Management Engine BIOS Extensions" screen. I am not sure on other motherboards/chipsets.