Hi. On Thu, May 26, 2022 at 08:13:39AM -0700, Peter Ehlert wrote: > /var/log now contains 29.3 GB > /var/log/syslog 10.0 GB > /var/log/kern.log 10.0 GB > /var/log/syslog.1 4.1 GB > /var/log/kern.log.1 4.0 GB
That's impressive, to say the least. > I have no clue why this happened The usual thing. Judging from the size of the kern.log, some kernel subsystem decided to generate a lot of messages, systemd-journald happily forwarded them to rsyslogd, and the latter wrote them. > how do I clean this up and prevent it from happening again? 1) Read the logs, understand what kind of messages are most frequent. 2) Purge the logs, i.e. :> /var/log/syslog :> /var/log/kern.log 3) Write appropriate rsyslogd filter rule, restart rsyslog afterwards For instance: :msg, contains, "eth0: renamed from " stop Note that you cannot filter messages at systemd-journald level, that sorry excuse for a "system journal" lack that capability. Reco