Ubuntu – delete /var/log files due to low root space

Simply delete these files and then reboot?

No. Empty them but do not use rm because it could end up crashing something while you are typing the touch command to recreate it.

Shortest method:

cd /var/log
sudo su
> lastlog
> wtmp
> dpkg.log 
> kern.log
> syslog
exit

If not root it will require sudo. Taken from another answer on AU.

BEFORE YOU DO THAT. Do a tail {logfile} and check if there is a reason for them to be so big. Unless this system is several years old there should be no reason for this and fixing the problem is better than letting this go on.

Both kern.log and syslog should normally not be that big. But like I said: if this system is up and running for years and years it might be normal and the files just need to be cleared.

And to prevent it to become that big in the future: setup logrotate. It is pretty straightforward and will compress the logfile when it becomes bigger then a size you set it to.

1 other thing: if you do not want to delete the contents you can compress the files by tarring or gzipping them. That will have you end up with files probably 10% of what they are now. That is if there is still room on the disk to do that.

I had the same problem. The log files grows very quickly and after a few hours it consumes all available space in /. At this point things start going really bad. Also the cups process hogs the CPU (100% in one core - that explains the 50% you see in a dual-cure).

Deleting the file at this point doesn't seem to help immediately. I guess the file is still in use by the cups process and it won't free the disk space... but after a reboot I got some free disk space and had time do investigate /var/log/cups/error_log.

Here's what I found in the first few lines

E [16/Oct/2016:09:48:02 +0300] MFCJ625DW: File \"/usr/lib/cups/filter/brother_lpdwrapper_mfcj625dw\" has insecure permissions (0100775/uid=0/gid=0).
E [16/Oct/2016:09:48:02 +0300] MFCJ625DW: Directory \"/usr/lib/cups/filter\" has insecure permissions (040775/uid=0/gid=0).
E [16/Oct/2016:09:48:02 +0300] MFCJ625DW: File \"/usr/lib/cups/filter/brother_lpdwrapper_mfcj625dw\" has insecure permissions (0100775/uid=0/gid=0).
E [16/Oct/2016:09:48:02 +0300] MFCJ625DW: Directory \"/usr/lib/cups/filter\" has insecure permissions (040775/uid=0/gid=0).
E [16/Oct/2016:09:48:03 +0300] Directory \"/usr/lib/cups/notifier\" has insecure permissions (040775/uid=0/gid=0).
W [16/Oct/2016:09:48:03 +0300] Notifier for subscription 1879 (dbus://) went away, retrying!
E [16/Oct/2016:09:48:03 +0300] Directory \"/usr/lib/cups/notifier\" has insecure permissions (040775/uid=0/gid=0).
W [16/Oct/2016:09:48:03 +0300] Notifier for subscription 1879 (dbus://) went away, retrying!
W [16/Oct/2016:09:48:03 +0300] Notifier for subscription 1879 (dbus://) went away, retrying!

And then the last warning is repeated over and over again... over 45000 times per second! (No wonder the disk is filled after a short time)

Assuming you have a similar problem, note that the thing cups keeps complaining about is very simple to fix:

Directory \"/usr/lib/cups/notifier\" has insecure permissions (040775/uid=0/gid=0).

Once you change the permissions with sudo chmod 755 /usr/lib/cups/notifier, the file should stop growing. (while you are at it, fix the other files it complains about).