25GB log file: /var/log/syslog1

Support and Help
,
1

Ubuntu Version:

Just updated to 25.04 (development), but I was on 24.10

Desktop Environment (if applicable):
KDE Plasma

Problem Description:
Today I’ve run filelight (KDE’s disk usage app) and find out that my /var/log/syslog.1 file is more than 25GB

du -h /var/log/syslog*
2,9M    /var/log/syslog
25G     /var/log/syslog.1
16M     /var/log/syslog.2.gz
1,2M    /var/log/syslog.3.gz
16M     /var/log/syslog.4.gz

I’ve installed Kubuntu less than 6 months ago (24.10 devel, now updated to 25.04 devel). I’m wondering if i can safely delete this file and how can I prevent it to become so big in the future.

I don’t know if this size may be related to the 25.04 update process. I didn’t check before updating.

Thanks!

2

You can delete it as it will be created when the system runs as you can see there are several syslog (as well as other log files). If you want to not have large syslog or other log files, stop doing whatever it is you were doing to create a file that large. Did you look at the newest syslog file, the 2.9MB file? You should see messages and information there that will point to the source of the problem. You should be familiar with these files if you are going to volunteer to test for Canonical.

3

Thanks for confirming I can remove it.
I was doing nothing different than a normal Desktop use… I’m not a tester for Canonical, I just want to have updated and new packages :slightly_smiling_face: Yes, I know all the risks of using a development distro, don’t worry. But I’m nothing more than a normal user.

I just can’t understand why the system doesn’t clean the logs. In professional activities it may be useful, but I’ve installed “Kubuntu Desktop” so I would expect the system to prevent a 25GB log. Nothing serious, just a waste of disk space

4

The logs are rotated (and compressed) weekly, if you have such a big log there must be something spamming it with messages. So before deleting it you should take a look inside to see what produces this spam (and fix this if possible)

2 Likes
5

Thank you,
I honestly don’t know how to inspect a 25 GB file having no idea what to look at. :slightly_smiling_face:

Is it possible that this log was created because I installed Kubuntu from a 24.10 daily ISO?

6

In a terminal:
less /var/log/syslog.1

Use arrow keys to scroll up/down, press q to quit

Or like this:
head -n 50 /var/log/syslog.1

Shows the first 50 lines of the file

tail -n 50 /var/log/syslog.1

Shows the last 50 lines.

You are probably looking for something that keeps repeating itself.

Let us know what you find.

7

Thanks. The log starts with an interesting:

2025-01-12T07:39:58.996887+01:00 enrico-kubuntu systemd[1]: logrotate.service: Deactivated successfully.
2025-01-12T07:39:58.997011+01:00 enrico-kubuntu systemd[1]: Finished logrotate.service - Rotate log files.
2025-01-12T07:39:58.997197+01:00 enrico-kubuntu rsyslogd: [origin software="rsyslogd" swVersion="8.2406.0" x-pid="1638" x-info="https://www.rsyslog.com"] rsyslogd was HUPed
2025-01-12T07:39:59.792210+01:00 enrico-kubuntu kded6[2348]: kf.service.sycoca: The menu spec file ( "" ) contains a Layout or DefaultLayout tag without the mandatory Merge tag inside. Please fix it.
2025-01-12T07:39:59.792269+01:00 enrico-kubuntu kded6[2348]: kf.service.sycoca: The menu spec file ( "" ) contains a Layout or DefaultLayout tag without the mandatory Merge tag inside. Please fix it.

I really don’t remember to have ever used any command to disable the logrotate service. I can’t even exclude it was my fault, but it seems to be a recent command (1 wk ago) and I didn’t make any test in the last days

I have really tons of

2025-01-12T19:59:52.545074+01:00 enrico-kubuntu env[72553]: [72553:0112/195952.545041:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission denied (13)
2025-01-12T19:59:52.545078+01:00 enrico-kubuntu env[72553]: [72553:0112/195952.545060:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission denied (13)
2025-01-12T19:59:52.545086+01:00 enrico-kubuntu env[72553]: [72553:0112/195952.545078:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission denied (13)

I ran this command which should count the lines where this error appears, at least in my intentions

grep "address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission denied (13)" /var/log/syslog.1 | wc -l

and it returns 146.851.700. I can’t scroll this infinite list, but it seems to have been added all in few minutes as you can see in the timestamps.

Very non-scientific test: I need to hold “pag down” for 36 seconds before moving to the next minute…

8

Search google for ‘Failed to recv from netlink socket: Permission denied’ you find a lot of entries, see if some can help you.

2 Likes
9

Hello, I wasn’t able to understand why that huge log has been created. I just deleted the syslog.1 file and checked that logrotate (systemctl status logrotate.timer) was still active (it is).

I’ll check in the next weeks if this happens again.

Thanks

2 Likes