Problem with /var

[Maureen Thomas]

I am running Debian 12 fulled updated. I keep getting a message saying
that my /var is almost full.  What can I safely delete to make more room
for it.  It is an HP Desktop Mo1-F3xxx, 8gb ram, Realtec Audio, AMD
Ryzen 5 5600G.  I also have a 2TB Seagate HD plugged in for backups.

Any help will be greatly appreciated.

Moe

[Eben King]

Post by Maureen Thomas
I am running Debian 12 fulled updated. I keep getting a message saying
that my /var is almost full.  What can I safely delete to make more room
for it.

First, find out where the space is being used. Something like baobab
might be useful. It might the apt cache directory, or some gigantic log
file, or some file you placed there and forgot.

[Andy Smith]

Hi,

There are 15 files in Var and the biggest one is the cache file. Is it safe
to get rid of the contents of the whole file.  It takes up  57% of the
drive.

Do not go deleting files in /var; you don't know enough about their
purpose to do that safely. There are tools you can use to safely delete
things.

It is safe to clear apt-get's cache with:

$ sudo apt-get clean

If you still need to find space after that, show us where it's all gone.

The command line tool "ncdu" can be helpful but if you don't have it
then a combination of "du" and "sort" will be useful, e.g:

$ sudo du -xh /var | sort -rh | head -25

(top 25 largest directories in /var with human-readable units.)

Thanks,
Andy

[John Hasler]

There are 15 files in Var and the biggest one is the cache file. Is
it safe to get rid of the contents of the whole file. It takes up 57%
of the drive.

Run the command

sudo apt-get clean

That will remove the contents of that file.

[Felix Miata]

There are 15 files in Var and the biggest one is the cache file. Is it
safe to get rid of the contents of the whole file.  It takes up  57% of
the drive.

The cache directory in /var/ normally grows with every update and upgrade, holding
the downloaded packages from which those transactions sprout. In installations in
which space is limited, the content of that directory needs at least to be
monitored, while it's easier simply to empty it after updates and upgrades are
successfully completed:

sudo apt-get clean
or
sudo apt clean

Monitoring disk space consumption is eminently easy and straight-forward by
running the ncdu utility.

[Chris Green]

Post by Eben King

Post by Maureen Thomas
I am running Debian 12 fulled updated. I keep getting a message saying
that my /var is almost full.  What can I safely delete to make more room
for it.

First, find out where the space is being used. Something like baobab
might be useful. It might the apt cache directory, or some gigantic log
file, or some file you placed there and forgot.

One of the major users of space in /var is the systemd journal files.
Here's the sizes of /var subdirectories on my laptop:-

***@t470# du -sm *
5 backups
176 cache
1 ipp-usb
311 lib
1 local
0 lock
2586 log
1 mail
4 opt
0 run
8 spool
1 tmp
7 www

/var/log (which is where systemd puts its log files) is by far the
biggest. If you then go and look in /var/log you will almost certainly
find that nearly all the spoace sonsumed is in /var/log/journal, the
systemd journal files.

THe systemd journal file defaults for length of time they are kept and
maximum size etc. are OK[ish] for systems with lots of disk space but
are far too large for smaller systems.

On systems I have with limited space I modify /etc/systemd/journald.conf
to reduce disk usage, I set the SystemMaxUse and MaxRetentionSec
parameters.

[Default User]

On Fri, 7 Mar 2025,
Chris Green wrote:

-------------------
"THe systemd journal file defaults for length of time they are kept and
maximum size etc. are OK[ish] for systems with lots of disk space but
are far too large for smaller systems.

On systems I have with limited space I modify
/etc/systemd/journald.conf
to reduce disk usage, I set the SystemMaxUse and MaxRetentionSec
parameters."
--------------------

I have a 10Gb /var partition 46.9% full (was over 57% full before doing
sudo apt-get clean).

What would reasonable values be for the SystemMaxUse and
MaxRetentionSec parameters?


Also, a big chunk of /var is taken up by
/var/lib/flatpak/repo/objects,
which takes up 2.5Gb of the 10 Gb /var.

Note: I only use very few flatpaks, just Flatseal, LibreWolf, and DB
Browser for SQLite, and some system stuff not user added.
So I don't know why /var/lib/flatpak/repo/objects
takes up so much space.

Can /var/lib/flatpak/repo/objects safely be trimmed in order to save
space?

[Greg Wooledge]

I am running Debian 12 fulled updated. I keep getting a message saying that
my /var is almost full.  What can I safely delete to make more room for it. 
It is an HP Desktop Mo1-F3xxx, 8gb ram, Realtec Audio, AMD Ryzen 5 5600G.  I
also have a 2TB Seagate HD plugged in for backups.
Any help will be greatly appreciated.

Start with "apt-get clean", unless you are intentionally saving .deb
files.

If that doesn't get the job done, then you should actually go into /var
and *look* and see what's taking all the space.

Sample starter commands:

cd /var
du -sh *
find . -size +10M -ls

[Greg Wooledge]

du: invalid option -- '*'

Missing space between 'h' and '*' so the '*' was treated as an option,
which is invalid. The '*' is unnecessary anyway.

It's totally necessary.

***@hobbit:/var# du -sh
2.1G .
***@hobbit:/var# du -sh *
4.0M backups
124M cache
40K games
209M lib
4.0K local
0 lock
1.8G log
8.0K mail
4.0K opt
2.3M qmail
0 run
3.6M spool
32K tmp

In my case, most of the space is in the "log" subdirectory. So, if I
felt a need to prune stuff on this system, I would cd into log next,
and repeat the process, until I found something I felt it was safe to
truncate or remove.

(Removing log files is often ineffective, because they're kept open
by whatever's writing to them; truncating them works, though.)

[The Wanderer]

Post by Greg Wooledge

du: invalid option -- '*'

Missing space between 'h' and '*' so the '*' was treated as an option,
which is invalid. The '*' is unnecessary anyway.

It's totally necessary.
2.1G .
4.0M backups
124M cache
40K games
209M lib
4.0K local
0 lock
1.8G log
8.0K mail
4.0K opt
2.3M qmail
0 run
3.6M spool
32K tmp

My reflex would be to use

# du -h --max=1 /var/

or

***@host:/var# du -h --max=1

which gives very similar results (albeit in a different order) without
the use of the wildcard, but is of course extra typing.

There might be other reasons why the use of the wildcard would be
preferable; the one that springs to my mind is that I would expect it to
skip dotfiles (and dot-directories) if any are present, but I also
wouldn't expect there to be any in /var/.

I use du's '--max=' option fairly frequently, compared to how often I
use du at all. I find it useful, but your mileage may vary.

[Andy Smith]

Hi,

This is what I got

You didn't show us the "df" output before you did this so we don't know
how much, if anything, it freed up.

du: invalid option -- '*'

Missing space between 'h' and '*' so the '*' was treated as an option,
which is invalid. The '*' is unnecessary anyway.

du: cannot access 'sh': No such file or directory

Missing '-' before 'sh' so 'sh' was treated as a file and that didn't
exist.

3.7G .

"df" output would help us to see how much is actually free now.

There doesn't really look like that much you could delete. You could
configure journald to keep less logs but it's kind of a minimal saving.
If you don't use snaps then you could uninstall all of that and get some
space back, but probably you had a reason fro installing that.

Thanks,
Andy

[David Christensen]

...

I prefer:

2025-03-06 18:55:31 ***@laalaa ~/laalaa.tracy.holgerdanske.com
# cat /etc/debian_version ; uname -a
11.11
Linux laalaa 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03)
x86_64 GNU/Linux

2025-03-06 18:55:34 ***@laalaa ~/laalaa.tracy.holgerdanske.com
# du -d 2 -m /var | sort -rn | head
838 /var
496 /var/cache
474 /var/cache/apt
200 /var/lib
124 /var/lib/apt
83 /var/log
61 /var/lib/dpkg
56 /var/spool/cups
56 /var/spool
56 /var/log/journal


RTFM du(1) and head(1) for options. For example

2025-03-06 18:57:28 ***@laalaa ~/laalaa.tracy.holgerdanske.com
# du -m /var/cache | sort -rn | head -n 6
496 /var/cache
474 /var/cache/apt
406 /var/cache/apt/archives
9 /var/cache/perlindex
6 /var/cache/debconf
3 /var/cache/man


David

[Stefan Monnier]

I am running Debian 12 fulled updated. I keep getting a message saying that
my /var is almost full. What can I safely delete to make more room for it.

Depends on all kinds of things. Questions that come to mind:

- Why do you have a separate /var partition?
- How big is it and how much space do you have elsewhere on the same disk?
- What is that "it" that you want to make room for?
[...]

# du -d 2 -m /var | sort -rn | head

Agreed. I personally use just `du | sort -n` (I can't see the benefit
of the `-d2` and I rely on the terminal's scrolling to filter out the
small fry instead of using `-r` and `head`).
But indeed, the `-m` is a good idea, thanks (never bothered to look for
such a thing).


Stefan

[Greg Wooledge]

Post by Stefan Monnier
[...]

Post by David Christensen
# du -d 2 -m /var | sort -rn | head

Agreed. I personally use just `du | sort -n` (I can't see the benefit
of the `-d2` and I rely on the terminal's scrolling to filter out the
small fry instead of using `-r` and `head`).
But indeed, the `-m` is a good idea, thanks (never bothered to look for
such a thing).

Yeah, I didn't know about -m either. I know about -k because I come
from a commercial Unix background, where we have:

DU(1POSIX) POSIX Programmer's Manual DU(1POSIX)

SYNOPSIS
du [-a|-s] [-kx] [-H|-L] [file...]

and that's it. In such an environment, I might use something like

du -sk * | sort -n

and just live with the much larger numbers that are printed.
(I agree with the "let the terminal scroll the little ones away"
approach, by the way. As long as you're not accessing the system
over a slow connection.)

However, when giving advice to Maureen, I wasn't trying to give her
a complicated recipe. I was trying to give her *simple* commands
that she could use to investigate her system and find where the
space was being used. (Good thing I didn't go complicated, either,
as it turned out she even messed up "du -sh *".)

[Max Nikulin]

141523 517216 -rw------- 2 root root 529625088 Nov 7 21:42 ./lib/snapd/snaps/gnome-42-2204_176.snap

du -ms /var/lib/snapd

Likely you need to move this directory to another partition.

[David Christensen]

Post by Maureen Thomas
I am running Debian 12 fulled updated. I keep getting a message saying
that my /var is almost full.  What can I safely delete to make more room
for it.  It is an HP Desktop Mo1-F3xxx, 8gb ram, Realtec Audio, AMD
Ryzen 5 5600G.  I also have a 2TB Seagate HD plugged in for backups.
Any help will be greatly appreciated.
Moe

Short term solution:

# apt-get autoremove

# apt-get autoclean


Long term solution:

That sounds like the traditional problem of how to partition your disks
-- no matter how you do it, one partition always fills up first.


I have a SOHO network with various clients and a file server. I am the
only user on my Debian machines, so that simplifies things.


I put each Debian instance on a small, fast SSD. I use d-i to partition
manually as follows:

1 GB boot
1 GB encrypted swap
13 GB LUKS encrypted root


I keep the Debian instance small so that it fits onto a single "16 GB"
device -- HDD, SSD, USB flash drive, SD card, etc.. This expedites
image creation, expedites image restoration, and reduces image storage
requirements. Disaster recovery consists of restoring the last image,
updating the OS, and restoring the last /home backup.


I mount my file server personal directory at /samba/dpchrist and create
symlinks from /home/dpchrist/* to /samba/dpchrist/* directories as
desired. The idea is to keep terminals and Thunar responsive even if
the network or file server go down.


If you have a single computer, you could use a NAS, RAID, or HDD in
place of a file server.


David

[Peter Hillier-Brook]

Post by Maureen Thomas
I am running Debian 12 fulled updated. I keep getting a message saying
that my /var is almost full.  What can I safely delete to make more room
for it.  It is an HP Desktop Mo1-F3xxx, 8gb ram, Realtec Audio, AMD
Ryzen 5 5600G.  I also have a 2TB Seagate HD plugged in for backups.
Any help will be greatly appreciated.
Moe

Fully updated is probably the clue. If you run `sudo apt-get clean` it
will empty the apt cache and you will probably find a much reduced /var
usage. I did this recently for the same problem and regained several
gigabytes.

Peter HB