Log files (CUPS) grow so fast!

Question

the past few days I faced a strange issue with my computer. I discussed it here: Server logs are filling my hard disk, how do I fix this?

Shortly, log files (in cups folder) grow so fast! I did solve the problem but I'm afraid of facing it again. I need to know what cause it so that I can avoid it.

I'm not sure but does the fact that I don't separate the root and /home relevant ?

sudo parted -l


Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number|Start|End|Size|File System|Name|Flag
1|17.4K|20.0MB|20.0MB|fat16| |boot
2|20.0MB|489GB|489GB|ext4
3|489GB|500GB|10.6GB|linux-swap(v1)

UPDATE

the problem is back :(

the /var/log/sups is full again (444GB) I didn't do anything !

 ls -l /var/log/cups/

total 464543116
-rw-r----- 1 root adm 0 DEC 30 07:47 access_log
-rw-r----- 1 root adm 587 DEC 30 07:37 access_log.1.gz
-rw-r----- 1 root adm 259 DEC 29 07:59 access_log.2.gz
-rw-r----- 1 root adm 258 DEC 28 07:41 access_log.3.gz
-rw-r----- 1 root adm 255 DEC 27 07:23 access_log.4.gz
-rw-r----- 1 root adm 252 DEC 26 07:04 access_log.5.gz
-rw-r----- 1 root adm 230 DEC 25 07:44 access_log.6.gz
-rw-r----- 1 root adm 161 DEC 24 12:18 access_log.7.gz
-rw-r----- 1 root adm 475691855862 Jan 7 07:50 error_log
-rw-r----- 1 root adm 245 DEC 29 14:34 error_log.1.gz
-rw-r----- 1 root adm 0 Feb 29 29 2012 page_log




cat /etc/logrotate.d/cups

    /var/log/cups/*log {
    daily
    missingok
    rotate 7
    sharedscripts
    postrotate
             if [ -e /var/run/cups/cupsd.pid ]; then
                      invoke-rc.d --quiet cups force-reload > /dev/null
                      sleep 10
             fi
    endscript
    compress
    notifempty
    create 640 root lpadmin
    }

When I stop cups and remove the file by:

sudo service cups stop
sudo rm /var/log/cups/error_log
sudo service cups start

the problem gone but I'm afraid it will be back again

Answer 1

It looks like it's the error log that's filling up, not the access log.

1. Check the error log level ("LogLevel") in the config file located at /etc/cups/cupsd.conf.
   It should normally be "LogLevel warn" or "LogLevel error". If it's set to "debug" you will get a ton of messages you don't need.

2. Check the error log (/var/log/cups/error_log) for errors.
   Given the size, I would do tail -500 /var/log/cups/error_log > cups_errors, and then look at cups_errors; this file will only have the last 500 lines of the full error.

Answer 2

You could try to edit the AccessLogLevel of CUPS.

There are four modes:

• config Log when printers and classes are added, deleted, or modified and when configuration files are accessed or updated.
• actions Log when print jobs are submitted, held, released, modified, or canceled, and any of the conditions for config.
• all Log all requests.

The cupsd.conf is per default located at /etc/cups/cupsd.conf.

I'm not sure but does the fact that I don't separate the root and /home relevant?

Probably not.

Answer 3

First get access to a shell (tty, terminal).

If you can't log in, try booting into recovery mode, or log in to a tty session (Ctrl + Alt + F4)

While in the shell, run:

sudo rm /var/log/error_log*

This would free up space. And would allow the system to function normally.

As the problem is with cups, I'd recommend that you remove or upgrade it.

sudo systemctl stop cups.service
sudo apt purge cups
sudo apt update
sudo apt install cups