/var/log taking up WAY too much space

[alefeelsmoody]

Hey everyone, I'm a huge Linux noob and have tried to find answers but am not sure how to go about fixing this.

Basically, syslog.1, kern.log.1, ufw.log.1 are taking up WAY too much disk space, but I have no idea how to fix it. Trying to open them just opens the terminal and the log itself, but I don't know how to clear this in a way that lets me sleep at night.

[Aravisian]

You can clean the logs with:

sudo logrotate -f /etc/logrotate.conf

You can increase rotation and reduce how much is stored long term by editing the configuration for it:

sudo nano /etc/logrotate.d/rsyslog

With these values:

rotate 4
size 100M
compress

For the Firewall logging, try:

sudo ufw logging low

[alefeelsmoody]

Thank you! Trying now; is this something that's going to take a bit to get going? I closed the terminal thinking it was frozen in error and now there are duplicate log entries being created. Advice welcome if I have to delete these at all

[Aravisian]

ls -l /etc/logrotate.d/

If you have an extra file named as *.save, delete it.

sudo rm /etc/logrotate.d/rsyslog.save

Then try:

sudo logrotate -d /etc/logrotate.conf

[alefeelsmoody]

It certainly helped knock a lot of it down, though I don't fully understand that first line in your last reply

@Aravisian

ls -l /etc/logrotate.d/

My apologies for being so green, it's been a bit of a curve and I don't mess with the terminal often

[Aravisian]

ls is List
-l is long format
/etc/logrotate.d/ is the path to the directory to list

The command lists all the files in that directory.
You can do the same in GUI
In terminal, elevate the Nautilus File Manager (Files) to root:

nautilus admin:/

Then navigate "Other locations" in the left pane
"Computer" in right pane and follow the tree, etc, logrotate.d

and you can see the files listed. You can right click on a file to delete it - But Take Care Deleting Any Files in Root - these are system files.
The isolated file, if it exists to remove is:
rsyslog.save

Though it seems you got through the process above of cleaning old logs...

[alefeelsmoody]

Makes sense, and at least it's down to 91.6 gigs from the 219 it originally was. You've been a great help and I really do appreciate it <3

[Aravisian]

Further log cleaning can be done with

sudo journalctl --vacuum-size=500M

This will clean journalctl logs, which are different from syslog... But maybe it will help.