54 GB in /var/log!! -- UPDATE

[Beartooth]

On Tue, 28 Oct 2008 00:54:22 +0100, Björn Persson wrote:

> I Beartooth wrote:
	[....]
> Switching the KVM switch is equivalent to unplugging all the devices
> from one computer and plugging them into another. Linux will print some
> messages every time you plug in or remove a USB device, but you'd have
> to be switching like crazy to produce 54 GB of messages that way. I
> suppose a loose cable might make it seem like all the devices are
> constantly plugged in and removed, but I still don't quite see how the
> log could grow that big. The excerpt you posted was 3411 characters.
> Printing all of that once a second for a week would still produce only
> two gigabytes.
	[...]
>> 	Finally, an hour or so ago, I tried turning the printer off with
>> its power switch. Since that time, the messages have become fewer, but
>> not stopped.
> 
> I'd imagine that the messages about the printer have stopped, and the
> ones about the keyboard, the mouse and the hub continue. (There's a USB
> hub inside the KVM switch.) Every time you switch to another machine to
> look for new messages, you cause more messages.

	Right, about both; but some machines get more non-printer 
messages; I don't know why.

> Those messages aren't errors and you don't need to worry about them as
> long as the log doesn't grow out of control again. It's quite possible
> that most of those 54 GB was something completely different that hasn't
> resurfaced yet. I'd recommend doing "ls -l /var/log/messages*" now and
> then to keep an eye on it, and investigate further if it grows to many
> megabytes.

	I fiddled a bit with the command you suggested (for which, again, 
many thanks!), and eventually tried doing "$ ls -lh /var/log|less" -- 
which has the advantage that I need not use a terminal tab logged to root 
(nor sudo). Doing that on the #1 machine (where I am now) showed a bunch 
of stuff up to maybe 200K (for very few), and this : 

	[....]
-rw------- 1 root    root     26K 2008-10-28 12:37 messages
-rw------- 1 root    root    299K 2008-10-05 01:00 messages-20081005
-rw------- 1 root    root    266K 2008-10-12 03:11 messages-20081012
-rw------- 1 root    root    303K 2008-10-19 04:06 messages-20081019
-rw------- 1 root    root       0 2008-10-27 11:08 messages-20081026
	[....]

	I'd like to pipe that into top, or some such, to make it display 
only the files of 100K and up; but trying to read the man page for top, 
as usual for powerful commands, makes me think of standing at the foot of 
a huge cliff of ice.

	Somewhere in this thread is a way (or maybe a couple of ways) to 
skim those files without actually running through them. Maybe I can find 
it again.

	(I've also started skimming through root's mail; and I have to 
admit a lot more of it makes sense than last time I tried.)

-- 
Beartooth Staffwright, PhD, Neo-Redneck Linux Convert
Remember I know precious little of what I am talking about.