Thanks to all who replied and especially to "Pontus Goffe via Dng"
One of the many things I didn't know of was "ncdu" (so I installed it via Synaptic"). Apologies for the simplistic ap[proach to writing this back, it's so other newbies like me might understand what to do and how :-) So the answer is that both /var/log/syslog and /var/log/kern.log are both 18GB large - see details below. This was an issue reported at the link below so I'm working through that answer: https://askubuntu.com/questions/515146/very-large-log-files-what-should-i-do . . . which refers to another answer: https://stackoverflow.com/questions/35638219/ubuntu-large-syslog-and-kern-log-files The above answer includes a script to identify by line count of what is filling up the logs. these are it's results on my system: /var/log/syslog : 42432698 nucdevuan kernel: ACPI Error: [I*4_] Namespace lookup failure, AE_NOT_FOUND (20160831/psargs-359) 42432692 nucdevuan kernel: ACPI Exception: AE_NOT_FOUND, while evaluating GPE method [_L66] (20160831/evgpe-646) 42432691 nucdevuan kernel: ACPI Error: Method parse/execution failed [\_GPE._L66] (Node ffff9be70e1e6988), AE_NOT_FOUND (20160831/psparse-543) 127 nucdevuan kernel: random: udevd: uninitialized urandom read (16 bytes read) 110 .0 89 nucdevuan CRON: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) 84 nucdevuan kernel: ACPI: Executed 1 blocks of module-level executable AML code 84 nucdevuan kernel: ACPI: Dynamic OEM Table Load: 68 nucdevuan rtkit-daemon: Supervising 2 threads of 1 processes of 1 users. 68 nucdevuan dhclient: Sending on Socket/fallback /var/log/kern.log : 42432698 nucdevuan kernel: ACPI Error: [I*4_] Namespace lookup failure, AE_NOT_FOUND (20160831/psargs-359) 42432693 nucdevuan kernel: ACPI Exception: AE_NOT_FOUND, while evaluating GPE method [_L66] (20160831/evgpe-646) 42432692 nucdevuan kernel: ACPI Error: Method parse/execution failed [\_GPE._L66] (Node ffff9be70e1e6988), AE_NOT_FOUND (20160831/psparse-543) 127 nucdevuan kernel: random: udevd: uninitialized urandom read (16 bytes read) 110 .0 84 nucdevuan kernel: ACPI: Executed 1 blocks of module-level executable AML code 84 nucdevuan kernel: ACPI: Dynamic OEM Table Load: 67 nucdevuan kernel: IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready 66 .0: System wakeup disabled by ACPI 63 nucdevuan kernel: system 00:01: [io 0xffff] has been reserved Since it's a new install and the log sizes haven't increased by much since I got the system up to date from the install media and wrote my plea for help, it MAY be something that is already fixed in recent updates. As a quick and dirty hack I just zeroed out the above log files by sending nothing to them, replacing the existing contents: :/var/log# > syslog :/var/log# > kern.log and will monitor disk usage which is down to a healthy . . . $ df Filesystem 1K-blocks Used Available Use% Mounted on /dev/nvme0n1p4 62244612 4760504 54292512 9% / The details for anyone interested . . . The logging is set at the default levels (unchanged from install) and it would seem that they haven't been rolled over since the system was installed on 4/2/20 and today 15/2/20. My guess is that the files were too big to roll over. from /etc/logrotate.d# cat rsyslog (below) I see that syslog should be rotated every 7 days and kern.log every 4 weeks. owen@nucdevuan:/$ ncdu -x / --- / ------------------------------------------------------------------------------------------------------------------ . 34.1 GiB [##########] /var 3.6 GiB [# ] /usr :/var# tree --du . . . ├── [ 9] lock -> /run/lock ├── [36416792095] log │ ├── [ 56285] alternatives.log │ ├── [ 676842] apt │ │ ├── [ 70524] eipp.log.xz │ │ ├── [ 93573] history.log │ │ └── [ 508649] term.log │ ├── [ 140202] auth.log │ ├── [ 47520] bootstrap.log │ ├── [ 0] btmp │ ├── [ 21456] ConsoleKit │ │ └── [ 17360] history │ ├── [ 18404] cups │ │ ├── [ 11783] access_log │ │ ├── [ 2525] error_log │ │ └── [ 0] page_log │ ├── [ 331812] daemon.log │ ├── [ 363611] debug │ ├── [ 52204] dmesg │ ├── [ 52977] dmesg.0 │ ├── [ 14209] dmesg.1.gz │ ├── [ 1299392] dpkg.log │ ├── [ 22221] exim4 │ │ ├── [ 18125] mainlog │ │ └── [ 0] paniclog │ ├── [ 32032] faillog │ ├── [ 3976] fontconfig.log │ ├── [ 4591] fsck │ │ ├── [ 297] checkfs │ │ └── [ 198] checkroot │ ├── [ 8192] hp │ │ └── [ 4096] tmp │ ├── [18205380792] kern.log │ ├── [ 292292] lastlog │ ├── [ 4678] live │ │ ├── [ 246] boot.log │ │ └── [ 336] config.log │ ├── [ 1056] mail.err │ ├── [ 1056] mail.info │ ├── [ 1056] mail.log │ ├── [ 1056] mail.warn │ ├── [ 1429884] messages │ ├── [ 4096] mopidy │ ├── [ 31098] mpd-sima │ │ └── [ 27002] mpd-sima.log │ ├── [ 4096] ntpstats │ ├── [ 37532] pm-powersave.log │ ├── [ 21075] refractainstaller.log │ ├── [ 3972] slim.log │ ├── [ 4096] speech-dispatcher │ ├── [18205751941] syslog │ ├── [ 18341] user.log │ ├── [ 83722] wicd │ │ └── [ 79626] wicd.log │ ├── [ 239232] wtmp │ ├── [ 303659] Xorg.0.log │ └── [ 27343] Xorg.0.log.old . . . :/var/log# ls -al *log -rw-r--r-- 1 root root 56285 Feb 13 12:33 alternatives.log -rw-r----- 1 root adm 140202 Feb 15 10:36 auth.log -rw-r--r-- 1 root root 47520 Sep 20 13:21 bootstrap.log -rw-r----- 1 root adm 331812 Feb 15 10:26 daemon.log -rw-r--r-- 1 root root 1299392 Feb 15 10:31 dpkg.log -rw-r--r-- 1 root root 32032 Feb 7 13:52 faillog -rw-r--r-- 1 root root 3976 Feb 7 13:52 fontconfig.log -rw-r----- 1 root adm 18205380792 Feb 14 16:38 kern.log -rw-rw-r-- 1 root utmp 292292 Feb 7 13:52 lastlog -rw-r----- 1 root adm 1056 Feb 13 10:07 mail.log -rw-r--r-- 1 root root 37532 Feb 14 16:38 pm-powersave.log -rw-r--r-- 1 root root 21075 Feb 5 11:00 refractainstaller.log -rw-r--r-- 1 root root 3972 Feb 14 16:38 slim.log -rw-r----- 1 root adm 18205751941 Feb 15 10:26 syslog -rw-r----- 1 root adm 18341 Feb 13 21:30 user.log -rw-r--r-- 1 root root 303659 Feb 15 10:15 Xorg.0.log :/var/log# more syslog Feb 4 23:50:03 devuan liblogging-stdlog: [origin software="rsyslogd" swVersion="8.24.0" x-pid="2029" x-info="http://ww w.rsyslog.com"] start Feb 4 23:50:03 devuan kernel: [ 0.000000] Linux version 4.9.0-11-amd64 (debian-ker...@lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) ) #1 SMP Debian 4.9.189-3 (2019-09-02) Feb 4 23:50:03 devuan kernel: [ 0.000000] Command line: BOOT_IMAGE=/live/vmlinuz boot=live username=devuan Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers' . . . :/var/log# tail syslog Feb 15 06:17:01 nucdevuan CRON[20099]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Feb 15 06:25:01 nucdevuan CRON[20265]: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )) Feb 15 07:17:01 nucdevuan CRON[21283]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Feb 15 07:30:01 nucdevuan CRON[21534]: (root) CMD ([ -x /etc/init.d/anacron ] && if [ ! -d /run/systemd/system ]; then /usr/sbin/invoke-rc.d anacron start >/dev/null; fi) Feb 15 08:17:01 nucdevuan CRON[22476]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Feb 15 09:17:01 nucdevuan CRON[23644]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Feb 15 10:17:01 nucdevuan CRON[24870]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Feb 15 10:26:06 nucdevuan dbus[1928]: [system] Activating service name='org.freedesktop.PackageKit' (using servicehelper) :/var/log# more kern.log Feb 4 23:50:03 devuan kernel: [ 0.000000] Linux version 4.9.0-11-amd64 (debian-ker...@lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) ) #1 SMP Debian 4.9.189-3 (2019-09-02) Feb 4 23:50:03 devuan kernel: [ 0.000000] Command line: BOOT_IMAGE=/live/vmlinuz boot=live username=devuan Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers' Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR' Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: xstate_offset[3]: 832, xstate_sizes[3]: 64 Feb 4 23:50:03 devuan kernel: [ 0.000000] x86/fpu: xstate_offset[4]: 896, xstate_sizes[4]: 64 . . . :/var/log# tail kern.log Feb 14 16:38:36 nucdevuan kernel: [ 12.241603] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Feb 14 16:38:39 nucdevuan kernel: [ 15.104057] e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx Feb 14 16:38:39 nucdevuan kernel: [ 15.104102] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Feb 14 16:38:41 nucdevuan kernel: [ 17.310572] e1000e: eth0 NIC Link is Down Feb 14 16:38:41 nucdevuan kernel: [ 17.408751] e1000e 0000:00:1f.6: Failed to restore TIMINCA clock rate delta: -22 Feb 14 16:38:41 nucdevuan kernel: [ 17.537606] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Feb 14 16:38:41 nucdevuan kernel: [ 17.664285] e1000e: eth0 NIC Link is Down Feb 14 16:38:41 nucdevuan kernel: [ 17.933729] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Feb 14 16:38:45 nucdevuan kernel: [ 21.056197] e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx Feb 14 16:38:45 nucdevuan kernel: [ 21.056256] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready :/etc/logrotate.d# cat rsyslog /var/log/syslog { rotate 7 daily missingok notifempty delaycompress compress postrotate invoke-rc.d rsyslog rotate > /dev/null endscript } /var/log/mail.info /var/log/mail.warn /var/log/mail.err /var/log/mail.log /var/log/daemon.log /var/log/kern.log /var/log/auth.log /var/log/user.log /var/log/lpr.log /var/log/cron.log /var/log/debug /var/log/messages { rotate 4 weekly . . . Thanks again to all who responded. -- Owen On Thu, 13 Feb 2020, at 07:41, Joril via Dng wrote: > On 13/02/20 03:26, Owen wrote: > > > Any ideas how I can reclaim 30gb of my disk space please? > > You could try looking for huge directories with ncdu > _______________________________________________ > Dng mailing list > Dng@lists.dyne.org > https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng > _______________________________________________ Dng mailing list Dng@lists.dyne.org https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
