Monday, February 18, 2013

xsession-errors Log Filling Hard Drive Ubuntu

Last night, all of a sudden, I started getting poor performance out of my HTPC running Ubuntu 12.10 Quantal Quetzal, followed by a complaint that my /home partition was running low on space and only had ~350 MB of free space. A minute or so later, I got another warning that only ~35 MB were free! :O

I clicked the hard drive disk usage analyzation utility to figure out what was up, but it showed my largest directory as weighing-in at just ~29 GB.

Turns out the culprit was a gigantic, hidden file called .xsession-errors, which had ballooned to 170 GB over the course of a couple of hours, apparently. You can check if this is your problem by typing this into a terminal:
ls -a -s | grep xsession
This file is archived at every reboot, with the previous version renamed to .xsession-errors.old and a new log created in its place. If this file is the source of your troubles, you'll want to see what's been spamming your system with errors, but, obviously, such a huge file isn't going to open gracefully in a text editor. However, we can use the 'tail' command to check out the last few lines, like this:
tail -10 .xession-errors
That should give you an idea of what's causing your problems. Once you've had a good look, go ahead and delete the file and then reboot your system to free up the space:
rm .xession-errors* ; sudo reboot now
As soon as your system comes back up, look for the error log again using the first command (and then a third time to see if the size changed in between commands) and then open it in a text editor to see what's up:
gedit .xsession-errors
Scroll down to the bottom and see if you spot any errors repeating. In my case, there was a constant stream of errors from zeitgeist-daemon not being able to find file:///whatever/file.path. Zeitgeist is a program that keeps track of pretty much everything you do on your machine and uses that data to populate 'recent files' lists and so on. It also adds overhead to your system and occasionally shits the bed by making giant error logs ;)

If you don't mind getting rid of the Unity desktop, you can just flat-out remove it and its associated packages like this:
sudo dpkg -r zeitgeist*
However, if this is too invasive for you, you can use the following command to remove the read and write attributes from the zeitgeist-daemon database:
chmod -rw ~/.local/share/zeitgeist/activity.sqlite
You can test the effect out by typing:
zeitgeist-daemon --replace
It should error out with a complaint about not being able to access the database, which is exactly what we want. This essentially cripples the daemon without risking breaking any other packages, present or future.

Go about your normal tasks and make sure everything still works like it should (anything that used zeitgeist will obviously be broken, but I mean everything that you normally depend on). If all is well, you're finished. Pat yourself on the back.

UPDATE: The problem popped up again, even with zeitgeist removed, so I tailed the error log again and saw this line repeated over and over:
Authentication deferred - ignoring client message
This error appears to be a result of the vino server (Ubuntu's built-in VNC server) getting hammered with bruce-force login attempts. It appears that the server allows a few bad attempts and then ignores the rest, which is good. The attempts still get logged, though, so I thought it best just to remove vino altogether, since I never use it anyway:
sudo apt-get remove vino


Anonymous said...

Thank you! This is exactly what happened to me only my .xsession-errors was over 500GB. Even without removing vino, after deleting the error log and rebooting, things seemed OK. But I got rid of vino and plugged ports 5800 and 5900 on my firewall. I had opened them up to remote my computer while on vacation months ago. It's nice to find a clear description of the problem with logical fixes.

Hunter K. said...

I'm glad I could help :D

Brandon Hudson said...

Your post really cool and interesting. Thanks very much.

Acer - 15.6" Aspire Notebook - 4 GB Memory - 500 GB Hard Drive (E1-531-10004)

Acer - 15.6" Aspire Notebook - 6 GB Memory - 750 GB Hard Drive (V5-571-323)

Analytics Tracking Footer