Log files are essential on Linux systems, but they have a quiet habit of growing over time. If they are not checked occasionally, they can fill a disk and cause services to fail without much warning. The key is knowing how to clean them up safely, without breaking anything.
This guide walks through a calm, reliable process for checking log sizes and clearing them in a controlled way. Every command and example comes directly from the uploaded script and reflects real-world Linux administration practice .
Step 1: Confirm Logs Are the Problem
Before touching any files, verify that disk space is actually the issue.
df -h
You may see output similar to:
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 50G 47G 1.5G 97% /
This command shows how full each disk is. The Use% column is the most important part. Anything above 90 percent is a concern. Log files are commonly stored on the root filesystem, so they are often involved when space runs low.
In real IT work, this is one of the first checks when a system reports disk errors.
Step 2: Check the Size of the Log Directory
Next, confirm that logs are actually using a significant amount of space.
du -h –max-depth=1 /var/log
You might see output like:
900M /var/log
Or a breakdown such as:
700M /var/log/syslog
150M /var/log/auth.log
The /var/log directory is where most Linux logs live. The du command shows disk usage, and limiting the depth keeps the output readable. At this stage, you are looking for unusually large files.
Long-running servers often accumulate logs that no one checks until there is a problem.
Step 3: List Individual Log Files Clearly
Now look at the log files themselves.
ls -lh /var/log
Example output:
-rw-r–r– 1 root root 800M syslog
-rw-r–r– 1 root root 120M auth.log
The -lh options make file sizes easy to read. Large log files are not unusual, but unmanaged growth is what causes trouble. This step helps you decide which files actually need attention.
Step 4: Safely Empty a Log File
Log files should not be deleted. Instead, they should be emptied safely.
sudo truncate -s 0 /var/log/syslog
There is no output when this command succeeds.
What this does:
- truncate sets the file size to zero
- The file itself stays in place
- Services continue writing to the log normally
This avoids breaking applications that expect the log file to exist. In production environments, this is the standard emergency fix when logs fill a disk.
Step 5: Verify the Log Was Cleared
Always confirm the result.
ls -lh /var/log/syslog
You should see:
-rw-r–r– 1 root root 0 syslog
The log is now empty and ready to receive new entries.
Step 6: Repeat Only If Needed
If other logs are genuinely large, clear them one at a time.
sudo truncate -s 0 /var/log/auth.log
Go slowly and only clear files that are actually causing the issue.
Step 7: Recheck Disk Space
Finish by verifying that disk space has been restored.
df -h
You should now see something like:
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 50G 30G 20G 60% /
Verification is part of the process. Never skip this step.
Common Mistakes to Avoid
One common mistake is deleting log files with rm. Some services fail if their log files are missing. Empty the file instead.
Another mistake is clearing logs blindly. Always check file sizes first and only act on what is actually large.
Finally, forgetting to use sudo is common. Log files are system files, and permission errors are a sign that elevated access is required.
A Real-World Scenario
A production server stops processing jobs overnight. You access the console and see disk space errors. Checking /var/log reveals a runaway log file.
By safely truncating the log, you reclaim disk space and services recover without a restart. This situation happens regularly in real IT environments.
A Small Next Step
Once safe cleanup feels comfortable, the next improvement is automation. Linux includes tools that automatically rotate and compress logs so they do not grow endlessly.
That can come later. First, make sure manual cleanup feels calm and predictable.
Conclusion
Cleaning up logs does not have to feel risky. When you verify first, act deliberately, and confirm your results, log management becomes a routine maintenance task instead of a stressful emergency.
Work through these steps a few times, and the process will start to feel natural.