Join Log in
Score:1
Andrew Mititi avatar Ubuntu

log rotation for /var/log

cn flag
Andrew Mititi

I got an alert that the root directory is running out of space. On inspection using ncdu i found that the /var/log folder was taking alot space. Then further inspection shows that syslog and kern.log are the ones taking too much space. So i tailed the logs for both and found out that they are being written constantly and too fast and my issue is that the log information on each line is similar to an extent that for over 300 lines i manually inspected the log info is

Sep 10 00:50:02 amsabots kernel: [ 2421.158588] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158645] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158703] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158738] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164080] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164226] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164266] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164324] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164384] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164443] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164503] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164545] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164583] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164688] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164782] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164842] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164900] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164960] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165020] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165078] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165138] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165175] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.170990] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171140] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171188] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171290] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171338] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171381] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171500] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171646] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171739] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171799] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171858] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171917] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171976] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.172033] dpc 0000:00:1^C

I have gone through multiple solutions on how to fix this but none seem to really provide a solution. My suggestion which i would like further clarifications are as follows:

  1. Provide a file size limit to something like 1gb to /etc/logrotate.d/rsyslog - This will limit the log file size for all syslog to 1gb then be rotated if it goes past
  2. Set the logrotate for kern.log and auth.log to daily and reduce the number of rotated files to 2. for both sysylog, kern.log and auth.log
/var/log/syslog
{
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
    rotate 4
    weekly
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

Any advice on the impact of the changes i have listed above

75
0 + 0
log
hu flag
mikewhatever
There is no need to post screenshots of terminal windows to show some text output. Copy paste the text itself, it is much quicker, and makes it more readable.
1
Reply
waltinator avatar
it flag
waltinator
Summarize the logs. Count the columns (I could have if you'd posted text, not an image) and use `cut -c45-` to chop off the changing information (up to the time since boot in square brackets (# is a digit) "[######.######] ", pipe the results into ` | sort | uniq -c | sort -rn | tee saved.txt | less`. Fix the the problem. Stop the deluge!
0
Reply
Wayne Vosberg avatar
bd flag
Wayne Vosberg
Also please post the version of Ubuntu and the output of `lshw` and `uname -a`. If you google the "DPC containment event" it seems to indicate it could be a BIOS bug.
0
Reply
Organic Marble avatar
us flag
Organic Marble
Figure out how to stop the "DPC containment event". This is the problem, not the logs filling up. Don't treat the symptoms.
1
Reply
Andrew Mititi avatar
cn flag
Andrew Mititi
@mikewhatever i have edited the question to reflect your suggestions
0
Reply
Jakke avatar
in flag
Jakke
As an added bonus to this error, you've found out why /var should probably be on a different partition from your root. A simple issue can lock up your whole system this way while it would otherwise just lock up the /var (or /var/log) partition.
0
Reply
Nmath avatar
ng flag
Nmath
`/var` does not need to be on a different partition. Doing so will not make any difference and only places unnecessary restrictions on how space is used. Bad advice
0
Reply
Score:0
lnee avatar Ubuntu
td flag
lnee

First install stacer next: open stacer and goto "system cleaner" and click on "Select All" then blue butten above it. then click on "Select All" then blue butten. type in your password and your done.

0 + 0
Andrew Mititi avatar
cn flag
Andrew Mititi
Stacer did the job very well. Thanks
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.