Storage Consumed by /boot/efi and /var/log/journal

[darond]

Hi,

I recently noticed an odd increase in /boot/efi from Munin monitoring which shows that near the end of May it increased

But using NCDU from the CLI shows it much less than this size:

Apparently 8.3gb (Munin) vs. 83mb (NCDU).

I’m not quite sure how to interpret the Munin graph as it would suggest % consumed would be /, /run, /boot/efi added together (so circa 80%).

I also noted that my /var/log/journal has grown significantly to 2.4 gb

So the questions are:

1. I don’t believe there will be any impact from trimming the journal logs e.g.
   journalctl --vacuum-size=200M
   but I’m not familiar enough with them or mailinabox to know, is anyone able to confirm?
2. Is the growth in /boot/efi a false positive and is there any action I can take to recover the disk space.

For reference the drop in consumed space in October 2020 was when I off-loaded backups to a free S3 bucket, in case anyone is thinking of doing the same.

As always thanks to everyone for a great product. I’m enjoying learning about the product and linux administration in parallel.

[openletter]

@darond

I don’t believe there will be any impact from trimming the journal logs e.g.
journalctl --vacuum-size=200M

Here is an earlier discussion on this:

Journalctl -- reclaim space on small mailinabox

(continued) This freed-up about 1.8G, a significant amount in my case. I believe many are running miab on inexpensive, small VPS so perhaps this can help. Going forward, and assuming a similar volume of journals over the same period of time, I will have to repeat this work every four months.

There are various ways to accomplish this. I chose to set MaxRetentionSec=2months, but that is purely subjective.

I’m not sure about /boot/efi or the large bump there, but the large files are usually the various boot loader related files:

$ ll /boot/
total 141M
drwxr-xr-x  3 root root 4.0K Jul 22 06:08 ./
drwxr-xr-x 23 root root 4.0K Jul 21 06:09 ../
-rw-r--r--  1 root root 213K Jun 18 09:49 config-4.15.0-147-generic
-rw-r--r--  1 root root 213K Jul  9 13:19 config-4.15.0-151-generic
drwxr-xr-x  5 root root 4.0K Jul 22 06:08 grub/
-rw-r--r--  1 root root  58M Jul 21 06:08 initrd.img-4.15.0-147-generic
-rw-r--r--  1 root root  58M Jul 22 04:42 initrd.img-4.15.0-151-generic
-rw-------  1 root root 3.9M Jun 18 09:49 System.map-4.15.0-147-generic
-rw-------  1 root root 3.9M Jul  9 13:19 System.map-4.15.0-151-generic
-rw-------  1 root root 8.1M Jun 18 11:42 vmlinuz-4.15.0-147-generic
-rw-------  1 root root 8.1M Jul  9 13:23 vmlinuz-4.15.0-151-generic

You can always check man hier page to see what various directories are intended to be used for.

These should be maintained by, I think, unattended-upgrades. You can run sudo apt autoremove and before deleting anything it will ask to confirm, and you can check what it might want to remove.

You can also run sudo apt autoclean to remove some old cruft and I’ve never experienced a problem from running this command, though it does not ask for permission before deleting stuffs.

[darond]

Thanks Openletter, I have trimmed the journalctl successfully and limited to 10 days, recovered a not insignificant 2.2gb so thanks for that.

The /boot/efi one is an odd one as CLI showing EFI as tiny:

drwxr-xr-x  4 root root     4096 Jul 23 14:03 ./
drwxr-xr-x 23 root root     4096 Jul 23 14:01 ../
-rw-------  1 root root  4082393 Jun 18 17:49 System.map-4.15.0-147-generic
-rw-------  1 root root  4082629 Jul  9 21:19 System.map-4.15.0-151-generic
-rw-r--r--  1 root root   217414 Jun 18 17:49 config-4.15.0-147-generic
-rw-r--r--  1 root root   217414 Jul  9 21:19 config-4.15.0-151-generic
drwxr-xr-x  4 root root      512 Jan  1  1970 efi/
drwxr-xr-x  6 root root     4096 Jul 22 06:16 grub/
-rw-r--r--  1 root root 20887482 Jul 21 06:41 initrd.img-4.15.0-147-generic
-rw-r--r--  1 root root 20885181 Jul 23 14:03 initrd.img-4.15.0-151-generic
-rw-------  1 root root  8449696 Jun 18 19:42 vmlinuz-4.15.0-147-generic
-rw-------  1 root root  8453792 Jul  9 21:23 vmlinuz-4.15.0-151-generic

So not sure why Munin is reporting this as 8.51 % consumed (I realised I made the error in my original post of assuming this was 8.3gb).

[openletter]

Where is the server hosted? I wonder why I don’t have /boot/efi/.

[darond]

It’s a standard Ubuntu droplet from Digital Ocean. Just reflecting on the list for a moment the date also looks odd - Jan 1st 1970.

[latinhypercube]

Strange re date. I guess the file date is all zeroes for some unknown reason. 1 Jan 1970 being the beginning of the Unix epoch.