2

Yesterday I had almost 21 GB free on the SSD on which is Ubuntu installed.
Last night I was downloading a file about 800 MB... then I forgot to turn off the laptop...

Today I logged into Ubuntu and was faced with a warning saying that I have only 3 GB free space! Two minutes later I checked my root partition and saw that I have only 75 MB free space left!

Now I'm trying to uninstall some unnecessary applications from Software Center, but I can't uninstall any applications. I rebooted the OS, and tried to uninstall apps again, but I still can't do it, and neither can I update the OS using Software Center.

I'm using Ubuntu 17.04

I have 2 partitions, root and swap.

Can malware cause this problem?

What happened? What should I do?

df -h output:

Filesystem      Size  Used Avail Use% Mounted on
udev            7.8G     0  7.8G   0% /dev
tmpfs           1.6G   10M  1.6G   1% /run
/dev/sda1        58G   52G  2.6G  96% /
tmpfs           7.8G  100K  7.8G   1% /dev/shm
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           7.8G     0  7.8G   0% /sys/fs/cgroup
/dev/loop0      2.8M  2.8M     0 100% /snap/telegram-cli/22
/dev/loop1       60M   60M     0 100% /snap/notes/4
/dev/loop2      199M  199M     0 100% /snap/instagraph/31
/dev/loop3       82M   82M     0 100% /snap/core/2898
/dev/loop4      136M  136M     0 100% /snap/gimp/25
/dev/loop5      138M  138M     0 100% /snap/gimp/20
/dev/loop6       82M   82M     0 100% /snap/core/2844
tmpfs           1.6G  188K  1.6G   1% /run/user/1000
/dev/sdb5       367G  105G  244G  30% /media/msi/49e9738d-627e-4fca-b2f8-761203da60df
/dev/sda6        58G   12G   43G  21% /media/msi/7191eee5-72bd-40a7-9b1f-e4e6f6d20e80

sudo du -hd 1/ output:

32K ./.gnome
52K ./Desktop
40K ./PycharmProjects
28K ./Documents
260K    ./git
127M    ./.vscode
1.7M    ./.nv
341M    ./.xdm
42M ./.PyCharmCE2017.2
4.0K    ./Public
8.0K    ./.mplayer
24K ./.gconf
164K    ./.java
340K    ./VirtualBox VMs
24M ./Pictures
134M    ./msi-keyboard-gui-linux-x64
614M    ./PhpStorm-172.3317.83
44K ./.compiz
32M ./.mozilla
205M    ./.tor-browser-en
76K ./.pki
28K ./.moc
1.1G    ./.wine
648K    ./.eclipse
12K ./.idlerc
117M    ./Downloads
5.3M    ./env
4.0K    ./Videos
20G ./.local
608K    ./.atom
16M ./.PhpStorm2017.2
16K ./.p2
64K ./.WorldOfGoo
8.0K    ./.conda
3.7M    ./.thunderbird
411M    ./.PlayOnLinux
48K ./.vpnoneclick
12K ./.dbus
4.0K    ./Templates
4.0K    ./Music
12M ./psiphon
159M    ./.config
8.0K    ./.swt
68K ./.ipython
924M    ./.cache
1.4M    ./eclipse-workspace
20K ./.byteexec
4.0K    ./bin
25M ./.lantern
364K    ./.kde
64M ./snap
8.0K    ./.pylint.d
270M    ./opt
24K ./.steam
68K ./.tooling
24G .

Output of sudo du -hd 1 ~/.local/share:

360K    /home/msi/.local/share/gvfs-metadata
14M /home/msi/.local/share/zeitgeist
12K /home/msi/.local/share/icc
1.5M    /home/msi/.local/share/icons
4.0K    /home/msi/.local/share/unity-settings-daemon
232K    /home/msi/.local/share/shotwell
4.0K    /home/msi/.local/share/ibus-table
536K    /home/msi/.local/share/Foxit Software
8.0K    /home/msi/.local/share/nautilus
4.0K    /home/msi/.local/share/sounds
12K /home/msi/.local/share/gnome-mines
52K /home/msi/.local/share/webbrowser-app
19G /home/msi/.local/share/Steam
104K    /home/msi/.local/share/keyrings
32K /home/msi/.local/share/desktop-directories
60K /home/msi/.local/share/grilo-plugins
867M    /home/msi/.local/share/umake
4.0K    /home/msi/.local/share/previews
288K    /home/msi/.local/share/gnome-software
128M    /home/msi/.local/share/TelegramDesktop
4.0K    /home/msi/.local/share/gnome-settings-daemon
188K    /home/msi/.local/share/rhythmbox
204K    /home/msi/.local/share/applications
4.0K    /home/msi/.local/share/libertine
8.0K    /home/msi/.local/share/JetBrains
16K /home/msi/.local/share/vulkan
976K    /home/msi/.local/share/app-info
4.0K    /home/msi/.local/share/totem
176K    /home/msi/.local/share/mime
8.0K    /home/msi/.local/share/webkitgtk
16K /home/msi/.local/share/Trash
40K /home/msi/.local/share/ubuntu-download-manager
8.0K    /home/msi/.local/share/vlc
152K    /home/msi/.local/share/evolution
4.0K    /home/msi/.local/share/gnome-shell
20G /home/msi/.local/share

I installed steam 2 weeks ago, so it isn't causing this problem.

Forgot to say:
When I woke up... I saw the laptop login screen was on. It didn't turn off all night... and I saw the password input box in the login sceen was filling up with characters like: ******************************************************************

My root partition /dev/sda1 has 58 GB space

Update:

I think I found where the problem is. 

$ sudo apt install ncdu
$ ncdu
. 114.7 GiB [##########] /media                                                 
.  23.6 GiB [##        ] /home
.  19.6 GiB [#         ] /var
    5.5 GiB [          ] /usr
.   2.5 GiB [          ] /snap
    1.9 GiB [          ] /opt
  687.2 MiB [          ] /lib
  127.1 MiB [          ] /boot
.  14.9 MiB [          ] /etc
   11.3 MiB [          ] /sbin
   11.1 MiB [          ] /bin
.  10.1 MiB [          ] /run
    4.9 MiB [          ] /lib32
.  76.0 KiB [          ] /tmp
!  16.0 KiB [          ] /lost+found
.  12.0 KiB [          ] /dev
    4.0 KiB [          ] /lib64
e   4.0 KiB [          ] /srv
!   4.0 KiB [          ] /root
e   4.0 KiB [          ] /mnt
e   4.0 KiB [          ] /cdrom
!   4.0 KiB [          ] /Desktop
.   0.0   B [          ] /proc
.   0.0   B [          ] /sys
@   0.0   B [          ]  initrd.img.old
@   0.0   B [          ]  initrd.img
@   0.0   B [          ]  vmlinuz.old
@   0.0   B [          ]  vmlinuz

I realized that there is a file named:syslog.1 in /var directory. the size of the file is: 19 GB, so I think this is the problem! but can I delete it? What happens if I do that?

Image from /var/log/syslog.1:

file browser open on /var/log directory

Sss
  • 1,032

2 Answers2

2

You've got a stuck key on the keyboard. The stuck key is generating failed login requests that are filling up your logs.

Unplug the keyboard and use an external keyboard to prove this. This goes for both laptop and desktop machines.

ps: don't delete the syslog and syslog.1 files until you've reviewed them, as they're your only record of what went wrong

ps2: you've got a smallish SSD that may not be partitioned optimally. Show me a screenshot of gparted and tell me what's on sda6. Is sdb5 an external disk?

heynnema
  • 73,649
0

Ok good work, thanks for installing ncdu now all you need to do is clear the /var/log/syslog.1 but there is a special way to do this, do not delete the file because the file is needed and even if you create it manually, it will have the incorrect permissions. According to this link you can clear a log file with the following command:

> /path/to/log-file

example:

> /var/log/syslog.1

but before that, you must become root as with sudo it will not work. To temporarily become root you need to run the following command:

sudo -s

then you just run:

> /var/log/syslog.1

and that should do it. It will clear the space. Although this is not the proper way, it does the job. Please make sure you read the link I provided, it talks about log rotation, you need to rotate the logs rather than clearing them.

P.S. I just ran > /var/log/syslog.1 on my Ubuntu 16.04.3 and it worked fine.

If this answer helped you, please click the 'Accept` button.

Oh BTW, run sudo apt install shutter

It is a snipping tool that you can use to take screenshots.

EDIT: Additionally, if you want to inspect what went wrong, do not clear the log files as other posters have responded.

marko
  • 928
  • 5
  • 10