I've got my mom's computer running Ubuntu 12.04 LTS. It's been working just fine but all of the sudden syslog has been filling up. And by filling up I mean I just deleted a /var/log/syslog
that was 400GB in size. Yes - Gigabytes.
While I'm sure there was some useful information in there, I'm not sure that 400GB is any kind of information to sift through. And what's really amazing about it is that it happened within a period of 8 hours - I had ran df
around noon, and between then and now her drive filled up 30% (from just under 70% to 100%).
What could be causing this and how could I fix it?`
EDIT Looks like the usb is the offender:
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157829] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157836] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157842] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157849] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157857] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157863] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157870] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157877] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157884] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
Sep 8 08:52:10 pamela-desktop kernel: [ 6198.157891] usb 1-3: usbfs: process 1500 (demond_nscan) did not claim interface 3 before use
tail -n20 /var/log/syslog
to have a look at the last 20 lines.nscan
is a port-scanning application, so this might be someone's modification of it (but I'm just theorizing). If this isn't an application you are explicitly trying to run, I recommend trying to find the executable (something likefind / -iname demond_nscan
), and renaming it/changing it's permissions so it's not executable. (This way, if it's actually important for something, you haven't lost it, and if it's been launched by something else, you might notice. Also, checkcrontab -l
?