54 GB in /var/log!! -- UPDATE
Beartooth
Beartooth at swva.net
Tue Oct 28 16:53:25 UTC 2008
On Tue, 28 Oct 2008 00:54:22 +0100, Björn Persson wrote:
> I Beartooth wrote:
[....]
> Switching the KVM switch is equivalent to unplugging all the devices
> from one computer and plugging them into another. Linux will print some
> messages every time you plug in or remove a USB device, but you'd have
> to be switching like crazy to produce 54 GB of messages that way. I
> suppose a loose cable might make it seem like all the devices are
> constantly plugged in and removed, but I still don't quite see how the
> log could grow that big. The excerpt you posted was 3411 characters.
> Printing all of that once a second for a week would still produce only
> two gigabytes.
[...]
>> Finally, an hour or so ago, I tried turning the printer off with
>> its power switch. Since that time, the messages have become fewer, but
>> not stopped.
>
> I'd imagine that the messages about the printer have stopped, and the
> ones about the keyboard, the mouse and the hub continue. (There's a USB
> hub inside the KVM switch.) Every time you switch to another machine to
> look for new messages, you cause more messages.
Right, about both; but some machines get more non-printer
messages; I don't know why.
> Those messages aren't errors and you don't need to worry about them as
> long as the log doesn't grow out of control again. It's quite possible
> that most of those 54 GB was something completely different that hasn't
> resurfaced yet. I'd recommend doing "ls -l /var/log/messages*" now and
> then to keep an eye on it, and investigate further if it grows to many
> megabytes.
I fiddled a bit with the command you suggested (for which, again,
many thanks!), and eventually tried doing "$ ls -lh /var/log|less" --
which has the advantage that I need not use a terminal tab logged to root
(nor sudo). Doing that on the #1 machine (where I am now) showed a bunch
of stuff up to maybe 200K (for very few), and this :
[....]
-rw------- 1 root root 26K 2008-10-28 12:37 messages
-rw------- 1 root root 299K 2008-10-05 01:00 messages-20081005
-rw------- 1 root root 266K 2008-10-12 03:11 messages-20081012
-rw------- 1 root root 303K 2008-10-19 04:06 messages-20081019
-rw------- 1 root root 0 2008-10-27 11:08 messages-20081026
[....]
I'd like to pipe that into top, or some such, to make it display
only the files of 100K and up; but trying to read the man page for top,
as usual for powerful commands, makes me think of standing at the foot of
a huge cliff of ice.
Somewhere in this thread is a way (or maybe a couple of ways) to
skim those files without actually running through them. Maybe I can find
it again.
(I've also started skimming through root's mail; and I have to
admit a lot more of it makes sense than last time I tried.)
--
Beartooth Staffwright, PhD, Neo-Redneck Linux Convert
Remember I know precious little of what I am talking about.
More information about the fedora-list
mailing list