Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've got my mom's computer running Ubuntu 12.04 LTS. It's been working just fine but all of the sudden syslog has been filling up. And by filling up I mean I just deleted a /var/log/syslog that was 400GB in size. Yes - Gigabytes.

While I'm sure there was some useful information in there, I'm not sure that 400GB is any kind of information to sift through. And what's really amazing about it is that it happened within a period of 8 hours - I had ran df around noon, and between then and now her drive filled up 30% (from just under 70% to 100%).

What could be causing this and how could I fix it?`

EDIT Looks like the usb is the offender:

Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157829] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157836] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157842] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157849] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157857] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157863] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157870] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157877] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157884] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep  8 08:52:10 pamela-desktop kernel: [ 6198.157891] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
share|improve this question
2  
I'd say that instead of limiting the size, you should be trying to figure out what fills it. There should be lots of repeated messages, try running tail -n20 /var/log/syslog to have a look at the last 20 lines. –  mikewhatever Sep 7 '12 at 3:01
    
I did try that before hosing the file - nothing seemed to be repeated, but I'll take a look again –  Wayne Werner Sep 7 '12 at 16:52
    
So this looks like the problem is "demond_nscan", which I don't find anything about on google. nscan is a port-scanning application, so this might be someone's modification of it (but I'm just theorizing). If this isn't an application you are explicitly trying to run, I recommend trying to find the executable (something like find / -iname demond_nscan), and renaming it/changing it's permissions so it's not executable. (This way, if it's actually important for something, you haven't lost it, and if it's been launched by something else, you might notice. Also, check crontab -l? –  Steve Kroon Sep 8 '12 at 14:05
1  
demond_nscan looks like it's related to the lexmark scan drivers. –  Wayne Werner Sep 8 '12 at 21:37

3 Answers 3

up vote 7 down vote accepted

You should find out what is causing the large amount of messages, as if you fix this issue then you fix the large log file.

However, until then you can put in a log rotation base on one of the below.

  • time ( eg. rotate every day )
  • size ( eg. rotate when the file reaches 10mb )

This will already be setup on the system by default: /etc/logrotate.d/rsyslog

 /var/log/syslog
{
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
            reload rsyslog >/dev/null 2>&1 || true
    endscript
 }

From this you can see that it will rotate he /var/log/syslog file daily and keep 7 copies of the rotated file.

You can change this to be rotate on a size limit, say 1mb or reduce how many copies it stores.

Warning: This will not fix the root cause of your issue, however it will buy you some time as it will stop the file system from filling up.

  • Source: /etc/logrotate.d/rsyslog
  • Source: man logrotate
share|improve this answer

You are correct that demond_nscan is the Lexmark scan driver.

I've posted this same answer in your other posting you made related to this same issue. (Normally, I don't reply to double-posts, but I'll make this one-time exception for the benefit of folks who are coming in via Google search.)

What worked for me was completely purging the Lexmark scanner driver package and then re-installing it.

(The name of the package to purge is lexmark-network-scan)

share|improve this answer

I had the same problem with a Lexmark Pro915 for two weeks. I did two things, and it now works fine. I reinstalled the driver. (Don't think this was what helped.) I took out the USB extension I was using which made the total length almost 15' long and which might not have been entirely compatible. I suspect that the Lexmark driver for Linux systems might be detecting a poor, or poorly timed, signal and wanting to tell you about it 10 billion times a day. Try improving your connection somehow.

Logrotate and similar solutions didn't help me. Kern.log and syslog together were logging more than 1TB a day! Logrotate might help if you could set it to run every twelve minutes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.