Arch Linux

briareos90

Member

Registered: 2008-08-22

Posts: 3

Enormous size of /var/log

Hello, this is my first post in the forums, and im fairly new to archlinux. I couldn't login to gnome today, due to

/etc/gdm/Xsession: Beginning session setup...
/etc/gdm/Xsession: Setup done, will execute: /usr/bin/ssh-agent -- /usr/bin/gnome-session
mkdtemp: private socket dir: No space left on device

On investigating i found out that my /var directory had grown to an enourmous 14G. ls -l confirmed that my 'daemon.log' , 'errors.log' , and 'everything.log' were about 4G+ each.

[root@rogue log]# ls -l --human-readable | grep G
total 14G
-rw-r----- 1 root log  4.5G 2008-08-23 00:35 daemon.log
-rw-r----- 1 root log  4.5G 2008-08-23 00:35 errors.log
-rw-r----- 1 root log  4.6G 2008-08-23 00:47 everything.log

[root@rogue log]#cat daemon.log | tail
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.

[root@rogue log]#cat error.log | tail
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.

[root@rogue log]#cat everything.log | tail
Aug 19 03:18:49 rogue IN=ppp0 OUT= MAC= SRC=88.114.160.100 DST=59.93.241.85 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=15603 DF PROTO=TCP SPT=57958 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0 
Aug 19 03:18:52 rogue IN=ppp0 OUT= MAC= SRC=88.114.160.100 DST=59.93.241.85 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=15791 DF PROTO=TCP SPT=57958 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0 
Aug 19 03:18:54 rogue IN=ppp0 OUT= MAC= SRC=85.228.81.112 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=7510 DF PROTO=TCP SPT=56084 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0 
Aug 19 03:18:58 rogue IN=ppp0 OUT= MAC= SRC=83.103.213.123 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=2381 DF PROTO=TCP SPT=3966 DPT=13003 WINDOW=65535 RES=0x00 SYN URGP=0 
Aug 19 03:18:58 rogue IN=ppp0 OUT= MAC= SRC=88.114.160.100 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=16131 DF PROTO=TCP SPT=57958 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0 
Aug 19 03:19:00 rogue IN=ppp0 OUT= MAC= SRC=85.230.172.235 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=1442 DF PROTO=TCP SPT=63282 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0 
Aug 19 03:19:01 rogue IN=ppp0 OUT= MAC= SRC=83.103.213.123 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=3011 DF PROTO=TCP SPT=3966 DPT=13003 WINDOW=65535 RES=0x00 SYN URGP=0 
Aug 19 03:19:03 rogue IN=ppp0 OUT= MAC= SRC=85.230.172.23^C TOS=0x00 PREC=0x00 TTL
Aug 19 03:19:03 rogue IN=ppp0 OUT= MAC= SRC=85.230.172.23^C TOS=0x00 PREC=0x00 TTL
Aug 19 03:19:03 rogue IN=ppp0 OUT= MAC= SRC=85.230.172.23^C TOS=0x00 PREC=0x00 TTL

These logfiles are filled with repetations of nearly the same messages.

Any help on how to fix this issue, or the cause of this is appreciated.
Thanks a lot in advance
~Briareos

PS: Here's my dmesg output

[root@rogue log]#dmesg | tail
IN=ppp0 OUT= MAC= SRC=212.200.214.195 DST=59.93.192.245 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=12101 DF PROTO=TCP SPT=53443 DPT=28662 WINDOW=65535 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=49586 DF PROTO=TCP SPT=4185 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=50044 DF PROTO=TCP SPT=4185 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=50967 DF PROTO=TCP SPT=4185 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=52909 DF PROTO=TCP SPT=1710 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=53364 DF PROTO=TCP SPT=1710 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=54288 DF PROTO=TCP SPT=1710 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=222.216.28.125 DST=59.93.192.245 LEN=40 TOS=0x00 PREC=0x00 TTL=101 ID=256 PROTO=TCP SPT=6000 DPT=8080 WINDOW=16384 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=212.200.214.195 DST=59.93.192.245 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=18268 DF PROTO=TCP SPT=53598 DPT=28662 WINDOW=65535 RES=0x00 SYN URGP=0 
IN=ppp0 OUT= MAC= SRC=212.200.214.195 DST=59.93.192.245 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=18766 DF PROTO=TCP SPT=53598 DPT=28662 WINDOW=65535 RES=0x00 SYN URGP=0

Last edited by briareos90 (2008-08-22 20:04:51)

fwojciec

Member

Registered: 2007-05-20

Posts: 1,411

Re: Enormous size of /var/log

Something related to your ppp connection is spamming the log files?  Sorry, I don't have any experience with this so I can't make any useful suggestion with regard to fixing the problem...

EDIT: Do you use iptables, firestarter, or some sort of firewall?  That would be the likely culprit...

Last edited by fwojciec (2008-08-22 20:07:42)

briareos90

Member

Registered: 2008-08-22

Posts: 3

Re: Enormous size of /var/log

yeah im currently using firestarter. Btw do i need to be running fam ? because a reply in the archlinux mail archive, regarding the same famd error, said that fam is no longer needed due to gnome-vfs. i quote from http://www.archlinux.org/pipermail/arch … 11443.html:

On Sun, 2006-07-09 at 11:31 +0200, Firmicus at gmx.net wrote:
>
> Today after upgrading a bunch of packages I noticed
> that /var/log/errors.log was rapidly filling up to a monstrous 105MB,
> with the following message repeated zillions of time:
>
> > Jul  9 11:04:09 samarqand famd[3423]: fd 4 message length 1347375956
> bytes exceeds max of 4136.
>
> I killed the two running famd processes (why two?) and cleaned the
> errors.log file of those lines.
>
> Now what? Any idea about a posssible cause for this? NB: I run a gnome
> desktop from the current repo.

With gnome, you don't need to have fam running anymore, as gnomevfs uses
inotify to monitor files. KDE should do the same AFAIK.

fwojciec

Member

Registered: 2007-05-20

Posts: 1,411

Re: Enormous size of /var/log

I don't know about gnome-vfs (I don't use gnome) but I use gamin instead of fam.