Low disk space on filesystem root

[crashlanding]

After only two or three weeks of use my Ubuntu programming computer has run out of memory.
On August 26 I was not using the computer when it suddenly displayed this message:
“Low Disk Space on “Filesystem root”
The volume “Filesystem.root” has only 811.8 MB disk space remaining. You may free up some space by emptying the trash.”


The last two times this happened to me I emptied the trash and re-booted. The two computers this happened to never would re-boot. I want to try to recover some files from the first computer. I twice re-partitioned and re-formatted the drives on the second computer, and re-installed Ubuntu. I thought I had it set up perfectly, but now it is happening again.
Instead of emptying the trash I chose the other option “Examine”. This shows that my var folder is nearly full. And there is a new message: “Could not scan some of the folders contained in “/”. Error opening directory ‘/etc/cups/ssl’: Permission denied”.
I use this computer to write programs for Ubuntu using RAD Studio on a Windows computer that is connected to the Ubuntu computer via a network cable. I am using Ubuntu 20.04.6 LTS because it is still the newest version of Ubuntu that is supported by RAD Studio.
The only things I have installed on this computer are Screenshot, and the stuff to support RAD Studio. This includes PAServer, and some libraries.
Studying Disk Usage Analyzer I found that PAServer seems to be using only 114 MB. Lib is using 4.3 GB. Share is using 871 MB. Cache is using 88 MB. SFC is using 287 MB. Local Share Shotwell is using 80 MB. Log seems to be using 1.1 TB, and yet I see only about 5 GB in it. I don’t understand what is using all this memory. I took several pictures of the Disk Usage Analyzer display in case someone wants to look at it. I also looked at the drive using Disks and took screen shots. There are two partitions. The first is the OS, it has 537 MB. 483 MB free 10% full. The second partition is 2 TB, 755 GB free, 63.1 % full.


The first two computers came from Dell with Ubuntu installed. I partitioned, formatted and installed Ubuntu from a Flash Drive and let it use defaults, onto that second computer. The same thing has happened every time. I just looked in the trash bin and found there are six files totaling about 1.2 MB.


I don’t understand what is causing the problem. Do I need to expand the OS partition ? Does a folder have a size limit I need to adjust ? Please tell me how to fix this problem.

[ajgreeny]

I suspect from what you say that there is something spamming a log file or files in /var/log so have a look in more detail to see what is using all that space.

[yancek]

There are two partitions. The first is the OS, it has 537 MB.

No, it isn't. There is not way you can do an even minimal install of a current Ubuntu on a 537M partition. That could be your EFI partition. There is also no reason you would have log files the size you indicate unless you are making changes/modifying software and getting a lot of errors. Log seems to be using 1.1 TB. How did you get that information?

Try the following command to get information on log files and their size:

ls -lh /var/log

[crashlanding]

I got that information either from Disks, or Disk Usage Analyzer. Here is the result of ls -lh /var/log:


chris@LMTProg2:~$ ls -lh /var/log
total 1.6T
-rw-r--r--  1 root              root               0 Sep  1 00:00 alternatives.log
-rw-r--r--  1 root              root             38K Aug 12 15:21 alternatives.log.1
-rw-r-----  1 root              adm                0 Aug 11 00:00 apport.log
-rw-r-----  1 root              adm              226 Aug  9 21:53 apport.log.1
drwxr-xr-x  2 root              root            4.0K Sep  1 00:00 apt
-rw-r-----  1 syslog            adm              13K Sep  2 20:30 auth.log
-rw-r-----  1 syslog            adm              48K Sep  1 00:17 auth.log.1
-rw-r-----  1 syslog            adm             3.1K Aug 24 23:30 auth.log.2.gz
-rw-r-----  1 syslog            adm             4.6K Aug 17 23:30 auth.log.3.gz
-rw-r-----  1 syslog            adm             1.9K Aug 10 23:30 auth.log.4.gz
-rw-------  1 root              root               0 Aug 13 00:00 boot.log
-rw-------  1 root              root             11K Aug 13 00:00 boot.log.1
-rw-------  1 root              root             10K Aug 11 00:00 boot.log.2
-rw-r--r--  1 root              root            102K Mar 16  2023 bootstrap.log
-rw-rw----  1 root              utmp               0 Sep  1 00:00 btmp
-rw-rw----  1 root              utmp               0 Mar 16  2023 btmp.1
drwxr-xr-x  2 root              root            4.0K Sep  2 00:00 cups
drwxr-xr-x  2 root              root            4.0K Mar 14  2023 dist-upgrade
-rw-r--r--  1 root              adm              89K Aug 12 15:23 dmesg
-rw-r--r--  1 root              adm              87K Aug  9 21:45 dmesg.0
-rw-r--r--  1 root              root               0 Sep  1 00:00 dpkg.log
-rw-r--r--  1 root              root            1.3M Aug 12 15:21 dpkg.log.1
-rw-r--r--  1 root              root             32K Aug 12 15:21 faillog
-rw-r--r--  1 root              root             11K Aug 12 15:18 fontconfig.log
drwx--x--x  2 root              gdm             4.0K Jul 12  2021 gdm3
-rw-r--r--  1 root              root             46K Aug 12 15:23 gpu-manager.log
drwxr-xr-x  3 root              root            4.0K Mar 16  2023 hp
drwxrwxr-x  2 root              root            4.0K Aug  9 21:44 installer
drwxr-sr-x+ 3 root              systemd-journal 4.0K Aug  9 21:45 journal
-rw-r-----  1 syslog            adm              508 Sep  2 17:32 kern.log
-rw-r-----  1 syslog            adm             4.0K Sep  1 00:00 kern.log.1
-rw-r-----  1 syslog            adm             1.6K Aug 25 00:00 kern.log.2.gz
-rw-r-----  1 syslog            adm              27K Aug 18 00:00 kern.log.3.gz
-rw-r-----  1 syslog            adm              25K Aug 10 18:37 kern.log.4.gz
-rw-rw-r--  1 root              utmp            286K Aug 12 15:21 lastlog
drwxr-xr-x  2 root              root            4.0K Mar 22  2022 openvpn
drwx------  2 root              root            4.0K Mar 16  2023 private
drwx------  2 speech-dispatcher root            4.0K Jan 19  2020 speech-dispatcher
-rw-r-----  1 syslog            adm             980G Sep  2 21:10 syslog
-rw-r-----  1 syslog            adm             559G Sep  2 02:24 syslog.1
-rw-r-----  1 syslog            adm              15G Sep  1 01:10 syslog.2.gz
-rw-r-----  1 syslog            adm             7.0G Aug 31 02:26 syslog.3.gz
-rw-r-----  1 syslog            adm              15G Aug 30 01:10 syslog.4.gz
-rw-r-----  1 syslog            adm             7.1G Aug 29 02:29 syslog.5.gz
-rw-r-----  1 syslog            adm              15G Aug 28 01:08 syslog.6.gz
-rw-r-----  1 syslog            adm             6.8G Aug 27 02:34 syslog.7.gz
-rw-r--r--  1 root              root               0 Sep  1 01:10 ubuntu-advantage.log
-rw-------  1 root              root            4.8K Aug 12 15:01 ubuntu-advantage.log.1
-rw-r--r--  1 root              root               0 Sep  1 01:10 ubuntu-advantage-timer.log
-rw-r--r--  1 root              root            2.3K Aug 12 09:16 ubuntu-advantage-timer.log.1
drwxr-x---  2 root              adm             4.0K Sep  1 01:10 unattended-upgrades
-rw-rw-r--  1 root              utmp            2.7K Aug 12 15:23 wtmp
chris@LMTProg2:~$

[ubfan1]

Looks like syslog. examine it to see what's writing so much into it. It's just text (until compressed) so cat syslog | less should work.

[crashlanding]

I tried cat syslog | less...I tried it twice.
It seems to delete everything in terminal, except (END) The scroll bar becomes very short. When I try to scroll up to see if anything is there (END) goes to the bottom of the terminal and the rest of the lines above it have only a hyphen at the beginning. There are 24 hyphens and then (END)
I lose control of terminal and have to close it. That is, I can not get a command line. When I try to close terminal it tells me there is still a process running in this terminal. Closing the terminal will kill it. After a few minutes It still doesn't seem to be doing anything so I killed it.
Should I run cat syslog | less again and wait ? Can I open this file with a text editor ?

[ActionParsnip]

You can free space with the below commands:

> /var/log/syslog
> /var/log/syslog.1

Now you have space to work in, wait a short while and see if these files are ballooning again. Now they are a reasonable size, you can see what is spamming the file and address it

[crashlanding]

When you say something may be spamming a log file, do you mean over the internet, like a hack ? This computer was connected to the internet only while I installed Ubuntu, PAServer, and the libraries.

[deadflowr]

When you say something may be spamming a log file, do you mean over the internet, like a hack ?

Not necessarily.
More like there is some odd issue in the system that's causing it to post repeating lines over and over.

You don't know until you look at the logs and see.

usually you'll find one line repeating over and over
(or sometimes it's several lines in a block that keep repeating)

But once you see what it is, you can usually figure out how to stop it.

[ActionParsnip]

When you say something may be spamming a log file, do you mean over the internet, like a hack ? This computer was connected to the internet only while I installed Ubuntu, PAServer, and the libraries.

Not really. Something is writing to the log a lot. Once it's a reasonable size you read it. Not everything is necessarily a "hack".