I got an alert that the root directory is running out of space. On inspection using ncdu i found that the /var/log folder was taking alot space. Then further inspection shows that syslog and kern.log are the ones taking too much space. So i tailed the logs for both and found out that they are being written constantly and too fast and my issue is that the log information on each line is similar to an extent that for over 300 lines i manually inspected the log info is

Sep 10 00:50:02 amsabots kernel: [ 2421.158588] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158645] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158703] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158738] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164080] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164226] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164266] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164324] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164384] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164443] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164503] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164545] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164583] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164688] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164782] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164842] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164900] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164960] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165020] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165078] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165138] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165175] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.170990] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171140] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171188] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171290] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171338] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171381] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171500] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171646] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171739] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171799] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171858] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171917] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171976] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.172033] dpc 0000:00:1^C

I have gone through multiple solutions on how to fix this but none seem to really provide a solution. My suggestion which i would like further clarifications are as follows:

1. Provide a file size limit to something like 1gb to /etc/logrotate.d/rsyslog - This will limit the log file size for all syslog to 1gb then be rotated if it goes past
2. Set the logrotate for kern.log and auth.log to daily and reduce the number of rotated files to 2. for both sysylog, kern.log and auth.log

/var/log/syslog
{ rotate 7 daily missingok notifempty delaycompress compress postrotate /usr/lib/rsyslog/rsyslog-rotate endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{ rotate 4 weekly missingok notifempty compress delaycompress sharedscripts postrotate /usr/lib/rsyslog/rsyslog-rotate endscript
}

Any advice on the impact of the changes i have listed above

7

1 Answer

First install stacer next: open stacer and goto "system cleaner" and click on "Select All" then blue butten above it. then click on "Select All" then blue butten. type in your password and your done.

1

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy