Syslog.1 and kern.log.1 disk space problem? [Solved]

[Noax]

Hello again,

I am using MX Linux on this PC now since an few weeks and I am concerned about the following problem:





I cant open it and it will only get bigger. Its not an big problem on this machine, not yet atleast, because I have made the root partition relatively big but I want to ask:

- As I deleted it will it appear itself when it is needed?

- Will this logfile delete itself automatically in an few days or so to keep it from growing?

I just copied these 2 logfiles on an external HDD and deleted the original file as a root. I think this file got so big because of the updates and my experiments in these last few weeks. I hope I can just delete it in the future as I did now.
Atleast after several reboots and running some of my programs it doesnt appear so I think it isnt my system or hardware why this file appeared and got so big... or?

Here is my QSI:

Code: Select all

Snapshot created on: 20250318_1840
System:
  Kernel: 6.12.17-1-liquorix-amd64 [6.12-22~mx23ahs] arch: x86_64 bits: 64 compiler: gcc v: 12.2.0 parameters: audit=0
    intel_pstate=disable amd_pstate=disable BOOT_IMAGE=/boot/vmlinuz-6.12.17-1-liquorix-amd64
    root=UUID=<filter> ro quiet splash
  Desktop: Xfce v: 4.20.0 tk: Gtk v: 3.24.38 info: xfce4-panel wm: xfwm v: 4.20.0 vt: 7
    dm: LightDM v: 1.32.0 Distro: MX-23.6_x64 Libretto March 18  2025 base: Debian GNU/Linux 12
    (bookworm)
Machine:
  Type: Desktop Mobo: MSI model: Z170A GAMING PRO CARBON (MS-7A12) v: 1.0
    serial: <superuser required> UEFI: American Megatrends v: 1.80 date: 05/03/2017
CPU:
  Info: model: Intel Core i7-6700K bits: 64 type: MT MCP arch: Skylake-S gen: core 6 level: v3
    note: check built: 2015 process: Intel 14nm family: 6 model-id: 0x5E (94) stepping: 3
    microcode: 0xF0
  Topology: cpus: 1x cores: 4 tpc: 2 threads: 8 smt: enabled cache: L1: 256 KiB
    desc: d-4x32 KiB; i-4x32 KiB L2: 1024 KiB desc: 4x256 KiB L3: 8 MiB desc: 1x8 MiB
  Speed (MHz): avg: 2737 high: 4000 min/max: 800/4001 boost: enabled scaling:
    driver: acpi-cpufreq governor: ondemand cores: 1: 4000 2: 4000 3: 4000 4: 3755 5: 800 6: 800
    7: 3743 8: 800 bogomips: 63999
  Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
  Vulnerabilities:
  Type: gather_data_sampling status: Vulnerable: No microcode
  Type: itlb_multihit status: KVM: Split huge pages
  Type: l1tf mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
  Type: mds mitigation: Clear CPU buffers; SMT vulnerable
  Type: meltdown mitigation: PTI
  Type: mmio_stale_data mitigation: Clear CPU buffers; SMT vulnerable
  Type: reg_file_data_sampling status: Not affected
  Type: retbleed mitigation: IBRS
  Type: spec_rstack_overflow status: Not affected
  Type: spec_store_bypass mitigation: Speculative Store Bypass disabled via prctl
  Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer sanitization
  Type: spectre_v2 mitigation: IBRS; IBPB: conditional; STIBP: conditional; RSB filling;
    PBRSB-eIBRS: Not affected; BHI: Not affected
  Type: srbds mitigation: Microcode
  Type: tsx_async_abort mitigation: TSX disabled
Graphics:
  Device-1: NVIDIA TU116 [GeForce GTX 1660 SUPER] vendor: Micro-Star MSI driver: nvidia
    v: 535.216.03 non-free: 530.xx+ status: current (as of 2023-03) arch: Turing code: TUxxx
    process: TSMC 12nm FF built: 2018-22 pcie: gen: 2 speed: 5 GT/s lanes: 8 link-max: gen: 3
    speed: 8 GT/s lanes: 16 bus-ID: 02:00.0 chip-ID: 10de:21c4 class-ID: 0300
  Display: x11 server: X.Org v: 1.21.1.7 compositor: xfwm v: 4.20.0 driver: X: loaded: nvidia
    unloaded: fbdev,modesetting,nouveau,vesa alternate: nv gpu: nvidia display-ID: :0.0 screens: 1
  Screen-1: 0 s-res: 1920x1080 s-dpi: 96 s-size: 509x286mm (20.04x11.26") s-diag: 584mm (22.99")
  Monitor-1: DP-0 pos: primary res: 1920x1080 hz: 144 dpi: 81 size: 600x340mm (23.62x13.39")
    diag: 690mm (27.15") modes: N/A
  Monitor-2: HDMI-0 size-res: N/A modes: N/A
  API: OpenGL v: 4.6.0 NVIDIA 535.216.03 renderer: NVIDIA GeForce GTX 1660 SUPER/PCIe/SSE2
    direct-render: Yes
Audio:
  Device-1: Intel 100 Series/C230 Series Family HD Audio vendor: Micro-Star MSI
    driver: snd_hda_intel bus-ID: 1-13:5 v: kernel chip-ID: 1532:0504 alternate: snd_soc_avs
    class-ID: 0300 bus-ID: 00:1f.3 chip-ID: 8086:a170 class-ID: 0403
  Device-2: NVIDIA TU116 High Definition Audio vendor: Micro-Star MSI driver: snd_hda_intel
    v: kernel pcie: gen: 3 speed: 8 GT/s lanes: 8 link-max: lanes: 16 bus-ID: 02:00.1
    chip-ID: 10de:1aeb class-ID: 0403
  Device-3: Razer USA Kraken 7.1 Chroma type: USB driver: hid-generic,snd-usb-audio,usbhid
  API: ALSA v: k6.12.17-1-liquorix-amd64 status: kernel-api tools: alsamixer,amixer
  Server-1: PipeWire v: 1.0.0 status: active with: 1: pipewire-pulse status: active
    2: wireplumber status: active 3: pipewire-alsa type: plugin 4: pw-jack type: plugin
    tools: pactl,pw-cat,pw-cli,wpctl
Network:
  Device-1: Intel Ethernet I219-V vendor: Micro-Star MSI driver: e1000e v: kernel port: N/A
    bus-ID: 00:1f.6 chip-ID: 8086:15b8 class-ID: 0200
  IF: eth0 state: up speed: 1000 Mbps duplex: full mac: <filter>
Drives:
  Local Storage: total: 2.96 TiB used: 2.17 TiB (73.3%)
  SMART Message: Unable to run smartctl. Root privileges required.
  ID-1: /dev/nvme0n1 maj-min: 259:0 vendor: Samsung model: SSD 970 EVO Plus 1TB size: 931.51 GiB
    block-size: physical: 512 B logical: 512 B speed: 31.6 Gb/s lanes: 4 type: SSD serial: <filter>
    rev: 4B2QEXM7 temp: 33.9 C scheme: GPT
  ID-2: /dev/sda maj-min: 8:0 vendor: Seagate model: ST2000DM001-1ER164 size: 1.82 TiB
    block-size: physical: 4096 B logical: 512 B speed: 6.0 Gb/s type: HDD rpm: 7200 serial: <filter>
    rev: CC26 scheme: GPT
  ID-3: /dev/sdb maj-min: 8:16 vendor: Samsung model: SSD 750 EVO 250GB size: 232.89 GiB
    block-size: physical: 512 B logical: 512 B speed: 6.0 Gb/s type: SSD serial: <filter> rev: 1B6Q
    scheme: GPT
Partition:
  ID-1: / raw-size: 307.32 GiB size: 301.43 GiB (98.08%) used: 42.93 GiB (14.2%) fs: ext4
    dev: /dev/nvme0n1p2 maj-min: 259:2
  ID-2: /boot/efi raw-size: 256 MiB size: 252 MiB (98.46%) used: 274 KiB (0.1%) fs: vfat
    dev: /dev/nvme0n1p1 maj-min: 259:1
  ID-3: /home raw-size: 623.94 GiB size: 613.08 GiB (98.26%) used: 350.53 GiB (57.2%) fs: ext4
    dev: /dev/nvme0n1p3 maj-min: 259:3
Swap:
  Kernel: swappiness: 15 (default 60) cache-pressure: 100 (default)
  ID-1: swap-1 type: file size: 4 GiB used: 1.93 GiB (48.2%) priority: -2 file: /swap/swap
Sensors:
  System Temperatures: cpu: 25.0 C pch: 32.0 C mobo: N/A gpu: nvidia temp: 31 C
  Fan Speeds (RPM): N/A gpu: nvidia fan: 43%
Repos:
  Packages: 2729 pm: dpkg pkgs: 2712 libs: 1508 tools: apt,apt-get,aptitude,nala,synaptic pm: rpm
    pkgs: 0 pm: flatpak pkgs: 17
  No active apt repos in: /etc/apt/sources.list
  Active apt repos in: /etc/apt/sources.list.d/debian-stable-updates.list
    1: deb http://deb.debian.org/debian/ bookworm-updates main contrib non-free non-free-firmware
  Active apt repos in: /etc/apt/sources.list.d/debian.list
    1: deb http://deb.debian.org/debian/ bookworm main contrib non-free non-free-firmware
    2: deb http://security.debian.org/debian-security/ bookworm-security main contrib non-free non-free-firmware
  Active apt repos in: /etc/apt/sources.list.d/mx.list
    1: deb http://ftp.halifax.rwth-aachen.de/mxlinux/packages/mx/repo/ bookworm main non-free
    2: deb http://ftp.halifax.rwth-aachen.de/mxlinux/packages/mx/repo/ bookworm ahs
Info:
  Processes: 362 Uptime: 3h 18m wakeups: 1 Memory: 15.59 GiB used: 1.87 GiB (12.0%) Init: SysVinit
  v: 3.06 runlevel: 5 default: graphical tool: systemctl Compilers: gcc: 12.2.0 alt: 12
  Client: shell wrapper v: 5.2.15-release inxi: 3.3.26
Boot Mode: UEFI

Thank you again for answering to my qeustions.

[MXRobo]

I can't answer regarding deleting Syslog.1 and kern.log.1 specifically - hopefully others with more linux experience/knowledge can - but you might try
MX Cleanup, just press Apply. And maybe set automatic clean to monthly, weekly.

Also, some members had specific problems with some log files (don't know which ones) becoming very very large - again, I believe it was a specific problem.

Cheers!

[Noax]

Thank you for your answer MXRobo.

So I researched a bit more and I want something confirmed from an experienced user what I belief is the "solution":

Firstly these 2 ".1" files are just the "syslog" and "kern.log" files that got "rotated" through the programm "logrotate"?

Secondly because these files got "rotated" they arent in use from the system and I could safely delete it? (what I already did...)

Thirdly these files will appear itself automatically when the 2 files descriped above will get too big again?

Last qeustion: Its "normal" when in "normal desktop use" /var/log is not more then an few mb big? Its unnormal when it gets like over 1 GB?

Now my /var/log is about 7,4 mb big. I hope it will stay on the mb site now... I am done with eperiementing and as I can see it all of my things functions...

I looked with tail -n 100000 syslog.1 and kern.log.1 in these big data and I didnt understand a thing... I am unable to guess why they got so big... I have syslog.2.gz and syslog.3.gz and kern.log.2.gz and kern.log.3.gz and all of these are only a few mb big. All of my system functions. Why they got so big...?
Thats something to "look forward" ion the future... now my sylog and kern.log only get a few kb bigger on each reboot. Hopefully this will last...

[fehlix]

Hello again,

I am using MX Linux on this PC now since an few weeks and I am concerned about the following problem:


I cant open it and it will only get bigger. Its not an big problem on this machine, not yet atleast, because I have made the root partition relatively big but I want to ask:

- As I deleted it will it appear itself when it is needed?

- Will this logfile delete itself automatically in an few days or so to keep it from growing?

That's probaly related to a potential regression introduced with newer kernel, where now the kernel spams the log file.
One way to solve this issue, is to get to loglines, which get send every couple of seconds.
Sometimes those enrties are discussed with the kernel.org related forums, and you might find a hint how to suppress those.

E.g. within my system, I added kernel boot parameter "pcie_aspm=off", with help of this entry with /etc/default/grub:

Code: Select all

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash pcie_aspm=off"

which can be done also with the "MX Boot Options" tool.
But in your case it maybe a different boot option needed, if any is available to silence the kernel a bit.

To reduce the sizes of the log files:
This is configurable through those line below within /etc/logrotate.d/rsyslog

Code: Select all

/var/log/syslog
/var/log/mail.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/cron.log
{
	rotate 4
	weekly
	missingok
	notifempty
	compress
	delaycompress
	sharedscripts
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}

To adjust, maybe add a maxsize limit a to half a GB, by adding line like this:
maxsize 512M
So the file look like this:

Code: Select all

/var/log/syslog
/var/log/mail.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/cron.log
{
	rotate 4
	weekly
	maxsize 512M
	missingok
	notifempty
	compress
	delaycompress
	sharedscripts
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}

Thits will keep max 5 files, e.g. like this: syslog and syslog.1 etc.

Code: Select all

/var/log/syslog
/var/log/syslog.1
/var/log/syslog.2.gz
/var/log/syslog.3.gz
/var/log/syslog.4.gz

And the rotation will take place whatever comes first, either weekly or if the size exceeds the maxsize limit.
Yes, you can remove the syslog file, it will be created by the kernel with lot's of spam-lines.

You may simply reboot to

[Noax]

Thank you very much for your answer, fehlix

I set up pcie_aspm=off in be kernel-parameters in MX-Boot options and edited the rsyslog file with the new parameter "maxsize 512M".
I hope this will solve any future "logfile related size problems".

Last qeustion: When logrotate rotated all 5 files and is now rotating the 6th file will be the first one that got rotated deleted automatically to preserve space?

[fehlix]

Thank you very much for your answer, fehlix

I set up pcie_aspm=off in be kernel-parameters in MX-Boot options and edited the rsyslog file with the new parameter "maxsize 512M".
I hope this will solve any future "logfile related size problems".

Last qeustion: When logrotate rotated all 5 files and is now rotating the 6th file will be the first one that got rotated deleted automatically to preserve space?

yes, that's the way they move up the last one syslog.4.gz witl be replace by the now renamed from syslog.3.gz to syslog.4.gz

[Noax]

Alrighty

Thank you again fehlix. I think, this will do it :)
My system functions and I dont get any idea even when I look at the timestamps why these 2 logfiles got so big. Because it simply all functions...
But this will hopefully do it and I can scratch this topic.

Have a nice night/day fellow MX Linux users :)