Ubuntu 10.10. Space increase and large file problem.

[ArisVer]

Hello,

I install Ubuntu three weeks ago. Three partitions, a /boot, a /(swap), and a /(root). A week ago, i used GParted Live and increased /root from 20GB (i had used about 17GB) to 95GB. Within a week, /root went to 65GB used. I have done a few updates but did not install anything that big. Is that normal?

On checking i found the following.
In /var/log (of /root), there is a kern.log @ 5.2GB, a kern.log.1 @ 13.3GB, a messages @ 5.2GB and a messages.1 @ 13.3GB. They look like backup files or copies (i was thinking to erase them).
There is also a syslog @ 1.1GB in the same folder.
The rest of the files are in the bytes and KB range.

Something worth mentioning that may have effect, is that i 'accidentally' pressed "dd<Enter>" in the terminal.

 

[Nothinman]

Running dd wouldn't do that, dd stands for data dump and just takes data from one place to another. It's most commonly used for making images from discs but if you just run it with no arguments it just sits waiting for input from stdin.

If the kernel logs are that large you've got an issue with hardware or a driver. Take a look inside with less and see what's filling them up.

 

[ArisVer]

I see another two files now. ufl.log @ 5.4GB and ufl.log.1 @ 11.7GB.

Trying to open them, the CPU runs at 100&#37;, RAM fills up and the OS is almost stuck.
I had to use terminal, and kill application (gedit).


Update.
This is a copy from kern.log that i managed to see before getting stuck. The lines are repeated over and over.
My wlan0 is working properly.

Apr 10 08:00:14 aris-K7S5A kernel: [50906.345672] [UFW AUDIT] IN=wlan0 OUT= MAC=00:18:39:1b:79:00:00:26:44:d6:b5:94:08:00 SRC=72.179.6.68 DST=192.168.10.3 LEN=129 TOS=0x00 PREC=0x00 TTL=112 ID=4447 DF PROTO=TCP SPT=54954 DPT=42888 WINDOW=539 RES=0x00 ACK PSH URGP=0

 

[lxskllr]

That makes sense. They're taking up too much memory to open, and view. Maybe you'd be better off deleting the logs, and keeping an eye on them, to see if they fill up again.

 

[ArisVer]

After i delete the logs must i create a new empty file? Both * and *.1?

 

[lxskllr]

After i delete the logs must i create a new empty file? Both * and *.1?

Nah, they'll be created as necessary. I'd check it often, until you're sure everything is stable. It sounds like things got out of control pretty quickly.

 

[ArisVer]

Files deleted.

Thank you.

 

[Nothinman]

I see another two files now. ufl.log @ 5.4GB and ufl.log.1 @ 11.7GB.

Trying to open them, the CPU runs at 100%, RAM fills up and the OS is almost stuck.
I had to use terminal, and kill application (gedit).


Update.
This is a copy from kern.log that i managed to see before getting stuck. The lines are repeated over and over.
My wlan0 is working properly.

Apr 10 08:00:14 aris-K7S5A kernel: [50906.345672] [UFW AUDIT] IN=wlan0 OUT= MAC=00:18:39:1b:79:00:00:26:44:d6:b5:94:08:00 SRC=72.179.6.68 DST=192.168.10.3 LEN=129 TOS=0x00 PREC=0x00 TTL=112 ID=4447 DF PROTO=TCP SPT=54954 DPT=42888 WINDOW=539 RES=0x00 ACK PSH URGP=0

That's why I said to look at them with less.

And that looks like you're logging every packet that passes through your machine, or at least your wireless interface, which explains why the logs are so large.

 

[ArisVer]

An update.
I also had to go root and delete the files from the trash.

The files mentioned above started to grow again. The first line lists IN=wlan0 OUT= and the next line lists IN= OUT=wlan0, and they repeat over and over.

How do i fix this without the need of deleting the files every week or two manually? I suspect that a program is doing the logging, but which one?

I can get rid of the wireless card, but my only option is an external ethernet usb card as i had a hardware issue with a pci realtek8139 ethernet card not being recognized from the beginning (Ubuntu says the chip is supported).

 

[Nothinman]

Changing the card won't work, IIRC those are kernel firewall packet logs. Every single package coming and going out of your PC is getting logged which is why those log files are growing so quickly. What did you use to configure the firewall?

 

[ArisVer]

I first installed Gufw 10.10.1. Then i installed another one, firestarter i think it was, which i deleted together with the files (thinking it might have something to do with it). I found and enabled my ADSL build in firewall, so i can delete Gufw if neccessary. I will see if it starts logging again with the usb ethernet. I removed the wireless card. And that is, if can connect again.

Today i could not connect. I could only go up to the ADSL with the browser. And i could ping to the next stage (the isp login portal). The local phone said everything was okay from their side. Desktop on Ubuntu and netbook on Xubuntu could not surf. A strange thing was that i could not ping the isp from the netbook.

So, i runned Ubuntu Live from both computers and everything is allright.
I also installed Debian on the netbook (testing oss on it) and again no problem as i am writing now from it. Both computers are connected via ethernet wire.

I do not know what went wrong, and double checked connections, passwords, settings. Last night i installed apache and added a sentence to the page to test. Today the sentence does not exist and my connection went to ....

Btw, this is maybe getting off topic. Please advice.

 

[Nothinman]

I'm not sure what happens when you remove Gufw or firestarter, but they're not the actual firewall, they're just a UI to configure the firewall in the kernel so it's possible the configuration is still there.

 

[ArisVer]

Only one network manager can be used for connections, and it seems i downloaded another one and messed my connections. My connection is fixed thanks to some irc help. I edited the /etc/network/interfaces and setup static ip's.

Firestarter, in /etc, has an inbound and an outbound folder (this could be the reason). I removed the application, and now i'm deleting the folder.

Gufw folder in /etc only has one file gufw.cfg. I will keep this one on, and keep an eye on those files.

Btw, Nothinman, i could not install applications from debian. From terminal using sudo apt-get install 'appl' nothing was happening. I also downloaded some packets but could not install them, my knowledge is limited. So, on my netbook i have Xubuntu 10.04 LTS (it runs with 50MB less RAM from Ubuntu).

 

[Nothinman]

The files won't help at runtime, type 'iptables -L' to see if there are any active firewall rules.

What exactly happened when you ran apt-get?

 

[ArisVer]

Running iptables gives me no clue of understanding. On the input/forward/output i see:
ufw-before-logging-input all
ufw-before-input all
ufw-after-input all
etc
I also see:
LOG all
DROP all
ACCEPT all
REJECT all
etc

Actually i am checking the configurations of Gufw now, and there are 'Log options', which they are enabled. They had a 'set level' which was 'full'. I will disable them.

With Debian i do not remember exactly what happened, but i could not install anything. I expected it (apt-get) to run like in Ubuntu and it did not. Strange since it's the same command line. Overall i liked the choice of what to install which is missing from Ubuntu. Ubuntu is nice, but has too many features for me.

 

[Nothinman]

It is the same command, Ubuntu is based on Debian. And you can remove the extra stuff from Ubuntu if you like, they even have (had?) an alternate install CD that could you get a very minimal system instead of the default desktop and then you can add whatever you want from there.

 

[ArisVer]

Yes, i learned some history of linux. The kernel, the person, a bit how linux came to life, redhat, it's employees , debian and ubuntu as a result. Somehow they do have their differences, even though small (rpm or apt).

I saw a mini install from ubuntu like debian, but from what people at irc told me, it's just better to release-upgrade (dist-upgrade for deb), and as you said, just uninstall anything i do not like/use. It is really not a problem, what i do not like is the traces of some programs that are left in because sometimes they do not get removed so well. Like empty or even loaded folders sometimes. I saw that in Ubuntu too.
And i cannot imagine of what is left in the configuration files.

 

[Nothinman]

If something is left behind accidentally that's a bug and you should report it. Global configuration files are left behind intentionally unless you "purge" a package.

 

[ArisVer]

I did not see a bug report application in Ubuntu (that is bad from their side). There is an https://bugs.launchpad.net/ubuntu to report bugs but an application in the system is much better. There is one in Debian.
I have read something on purge (i think it was using purge instead of remove), but have to refresh that.

I am reading the iptables at Ubuntu documentation pages, which are very informative and have almost everything you may need to know, and the standard is "Chain FORWARD (policy ACCEPT)". Mine is listed as "Chain FORWARD (policy DROP)". I assume this has something to do with a home LAN. I tried to set them all at ACCEPT and failed.