Re: Hibernate filled my /root

[Reco <recoverym4n@enotuniq.net>]

	Hi.

On Thu, May 26, 2022 at 08:13:39AM -0700, Peter Ehlert wrote:
> /var/log now contains 29.3 GB
> /var/log/syslog 10.0 GB
> /var/log/kern.log 10.0 GB
> /var/log/syslog.1 4.1 GB
> /var/log/kern.log.1 4.0 GB

That's impressive, to say the least.

>    I have no clue why this happened

The usual thing. Judging from the size of the kern.log, some kernel
subsystem decided to generate a lot of messages, systemd-journald
happily forwarded them to rsyslogd, and the latter wrote them.

>    how do I clean this up and prevent it from happening again?

1) Read the logs, understand what kind of messages are most frequent.
2) Purge the logs, i.e.

:> /var/log/syslog
:> /var/log/kern.log

3) Write appropriate rsyslogd filter rule, restart rsyslog afterwards
For instance:

:msg, contains, "eth0: renamed from " stop

Note that you cannot filter messages at systemd-journald level, that
sorry excuse for a "system journal" lack that capability.

Reco