DEV Community

Atul Anand Oraon
Atul Anand Oraon

Posted on • Updated on

How to cleanup Linux | Ubuntu

#linux #devops

Well, I recently got alerts on my local system getting full. But wait a minute.
I do not have a lot on my system. I got sus about it.
Just the usual thing which will come to my mind is to check, if, my Downloads dir got too big. Sheesh, not it isn't weighing just 16.5GB light.
Well, that's nothing.

I then went on to look at the rest of my folder structure. Nothing was to be found. Well, then I thought let's get on the journey to the West ;)

Sometimes we get to a point where despite very less or no usage

our Linux seems to get full. As if it got fed some nice extra large pizza with some extra cheese and chili flakes.

It is kind of funny, I had to look a lot for it.

With a lot of trial and error, I accumulated these ways.

Well, this tutorial also taught me a lot.

Youtube Tutorial

First off let's get a bit commanding.
Ahem, just paste this into your terminal to see the disk usage

For the HDD use this
df -TH | grep "/dev/sda"

For the nvme/ssd use this
df -TH | grep "/dev/nvme*"

The output would be like this


/dev/nvme0n1p6 ext4      194G  120G   65G  66% /
/dev/nvme0n1p5 ext4      990M  507M  415M  56% /boot
/dev/nvme0n1p1 vfat      269M   73M  197M  27% /boot/efi
Enter fullscreen mode Exit fullscreen mode

Let's now remove any unwanted dependencies 

sudo apt-get autoremove && sudo apt-get autoclean
Enter fullscreen mode Exit fullscreen mode

The auto clean will remove any broken library files.

Further remove the unwanted configs of removed dependencies

This command will purge any packages that were previously removed but left configuration files behind.

sudo apt purge $(dpkg -l | awk '/^rc/ {print $2}')
Enter fullscreen mode Exit fullscreen mode

Here's how it works:

    dpkg -l lists all installed packages
    awk '/^rc/ {print $2}' filters the output to only include 
packages with an 'rc' status (removed with config files left behind) 
and prints the second field (package name)
Enter fullscreen mode Exit fullscreen mode

Let's clear some cache

So in the Linux, our cache can be in two places

/var/cache
~/.cache
To clean them simply do this.

~ via  v20.10.0 
┌───────────────────
│
└─> du -sh .cache/
153M    .cache/

~ via  v20.10.0 
┌───────────────────
│
└─> cd .cache/

~/.cache 
┌───────────────────
│
└─> sudo apt clean
Enter fullscreen mode Exit fullscreen mode

This way you can clean your cache dir same goes for the /var/cache

System level files

As we know, systemd oversees both kernel and user-level processes, serving as the init process launched by the kernel during boot. Following this, systemctl orchestrates the startup of systemd and other crucial processes, first at the system level and then at the user level.
journald is one such process which handles the logging.

We can use journalctl to handle the logs.

Let's just simply type sudo journalctl

Smack it, You will se something like this in the output.

May 05 02:42:20 idea systemd-journald[447]: System Journal (/var/log/journal/13>
May 05 02:42:20 idea sudo[98578]: pam_unix(sudo:session): session closed for us>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
Enter fullscreen mode Exit fullscreen mode

BTW, to exit this log press q, or, you may prefer to watch all of it by pressing down arrow or scrolling.

Now let's make things simpler and see the previous boot logs.
Below is the command for that.
sudo journalctl -b

It will show you the similar log again.

Now lets list all the journals

journalctl --list-boots

And you would have something like this

-2 af75e0d9a21a45f28653826f41945f0e Sun 2024-05-05 02:42:20 IST—Sun 2024-05-05 >
-1 a68bb606747340c298469ca6d9c0a1d6 Sun 2024-05-05 13:29:28 IST—Sun 2024-05-05 >
 0 27d70b75e7624865bb37107c7d054b0c Sun 2024-05-05 14:48:15 IST—Sun 2024-05-05 >
lines 1-3/3 (END)
Enter fullscreen mode Exit fullscreen mode

You might find 8 to 10 entries too.

Now you can watch for the specific date, logs by simply wirting its index as displayed.

say sudo journalctl -b -2

You will have a nice list of logs.

May 05 02:42:20 idea systemd-journald[447]: System Journal (/var/log/journal/13>
May 05 02:42:20 idea sudo[98578]: pam_unix(sudo:session): session closed for us>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
May 05 02:42:21 idea python[98637]: /usr/local/bin/cpufreqctl.auto-cpufreq: lin>
Enter fullscreen mode Exit fullscreen mode

You can also watch since a particular duration say 4 hours.

Just type ahead sudo journalctl --since "4 hours ago"

Yet again you will have a lovely logs

May 05 13:29:28 idea kernel: Linux version 6.5.0-060500-generic (kernel@kathleen) (x86_64-linux-gnu-gcc-13 (Ubuntu >
May 05 13:29:28 idea kernel: Command line: BOOT_IMAGE=/vmlinuz-6.5.0-060500-generic root=UUID=08169e91-a06a-4efc-b9>
May 05 13:29:28 idea kernel: KERNEL supported cpus:
May 05 13:29:28 idea kernel:   Intel GenuineIntel
May 05 13:29:28 idea kernel:   AMD AuthenticAMD
May 05 13:29:28 idea kernel:   Hygon HygonGenuine
May 05 13:29:28 idea kernel:   Centaur CentaurHauls
May 05 13:29:28 idea kernel:   zhaoxin   Shanghai  
May 05 13:29:28 idea kernel: BIOS-provided physical RAM map:
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009efff] usable
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x000000000009f000-0x00000000000bffff] reserved
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x0000000000100000-0x0000000009afffff] usable
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x0000000009b00000-0x0000000009dfffff] reserved
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x0000000009e00000-0x0000000009efffff] usable
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x0000000009f00000-0x0000000009f11fff] ACPI NVS
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x0000000009f12000-0x000000009fffefff] usable
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x000000009ffff000-0x000000009fffffff] reserved
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x00000000a0000000-0x00000000a2363fff] usable
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x00000000a2364000-0x00000000a4563fff] reserved
May 05 13:29:28 idea kernel: BIOS-e820: [mem 0x00000000a4564000-0x00000000a456cfff] usable
Ma
Enter fullscreen mode Exit fullscreen mode

Now you might want to know how much disk usage does it takes.
Here's the command to know that.

sudo journalctl --disk-usage

Output will be like

Archived and active journals take up 48.0M in the file system.
Enter fullscreen mode Exit fullscreen mode

Now to mark the active journal logs as archived we need to rotate it, kind of like, closing the notebook.
Here's the command

sudo journalctl --rotate

Well this might be a bit confusing. Let me simplify it for you.
You can think of it as the journalctl is journaling. You went ahead
and told it to stop using this page and start writing the rest of the stuff
on the new page. That's what it is at core.

Taking the backup

Now for some reason you decide to take the backup of the logs.
As we know, the logs are really precious.

You can do it simply like this

sudo cp -r /var/log/journal/* /path/to/backup/directory/
Enter fullscreen mode Exit fullscreen mode

Or if you want to zip it

sudo tar czvf journal_backup.tar.gz /var/log/journal/*
Enter fullscreen mode Exit fullscreen mode

Now what if, you want to backup last 5 logs.
I got you

here is the command for it

sudo cp -r $(ls -lt /var/log/journal/ | grep systemd-journal | awk '{print $NF}' | head -n 5) /path/to/backup/directory/
Enter fullscreen mode Exit fullscreen mode

Here is the tar way

sudo tar czvf journal_backup.tar.gz $(ls -lt /var/log/journal/ | grep systemd-journal | awk '{print $NF}' | head -n 5)
Enter fullscreen mode Exit fullscreen mode

The awk '{print $NF}' part extracts the file or directory names from the output.

Deleting the journals

Now we have to delete a few journals. Consdier it like vacuum cleaning stuff.
Let's delete everything older than yesterday(the previous day)

sudo journalctl --vacuum-time 1d

This is my output since I already cleaned yesterday.

Vacuuming done, freed 0B of archived journals from /run/log/journal.
Vacuuming done, freed 0B of archived journals from /var/log/journal/13da9b9ba4b64ddebab4fcc2387bfa6d.
Vacuuming done, freed 0B of archived journals from /var/log/journal.
Enter fullscreen mode Exit fullscreen mode

Next you can again check your journalctl disk usage.

sudo journalctl --disk-usage
Enter fullscreen mode Exit fullscreen mode 
Archived and active journals take up 64.0M in the file system.
Enter fullscreen mode Exit fullscreen mode

Cleaning the thumbnails in the cache

You might do it if you like it.
Here's the command for that.

sudo rm -rf ~/.cache/thumbnails/*

Removing the old revisions of snaps

For my snappy friends I got you too.
You should put the below in a shell file and then run or
if you decide to directly paste it don't copy the set -eu part


# Set DISPLAY and XAUTHORITY environment variables to run in the 
# graphical environment without this notify-send does not work on my 
# machine

DISPLAY=:0
XAUTHORITY=~/.Xauthority

set -eu

LANG=C snap list --all | awk '/disabled/{print $1, $3}' |
    while read snaprename revision; do 
        snap remove "$snapname" --revision="$revision"
    done
DISPLAY=:0 notify-send "Cleaned the snappy snaps revisions ;)"
Enter fullscreen mode Exit fullscreen mode

Let's have some details about what it does.

  • set -eu: This line sets two options for the shell:
  • -e (errexit): Causes the shell to exit immediately, if any command exits with a non-zero status (i.e., an error).
  • -u (nounset): Treats unset variables as an error when they are referenced.
  • LANG=C : sets the language to English
  • awk '/disabled/{print $1, $3}' : looks for lines containing the word "disabled" and prints the 1st and 3rd field
  • while read snapname revision; do: This starts a while loop, that reads each line of output from the awk command. It assigns the 1st field to the variable snapname and the 3rd field to the variable revision.
  • snap remove "$snapname" --revision="$revision": This command removes the specified snap package ($snapname) at the specified revision ($revision) using the snap remove command.

Top comments (4)

Collapse
 
waterkip profile image
Wesley Schwengle •

I think you need to start reading the man pages of apt and apt-get, auto-clean does not remove broken libraries:

       autoclean (and the auto-clean alias since 1.1)
           Like clean, autoclean clears out the local repository of retrieved package files. The difference is that it only removes package files that can no longer be downloaded,
           and are largely useless. This allows a cache to be maintained over a long period without it growing out of control. The configuration option APT::Clean-Installed will
           prevent installed packages from being erased if it is set to off
Enter fullscreen mode Exit fullscreen mode

Using apt clean in a directory won't do anything for that directory, unless it is the cache directory for apt and friends, apt clean clears the /var/cache/apt/archive directory.

Collapse
 
ccoveille profile image
Christophe Colombier •

Your list is good, but you should have a look at debfoster tool.
It will help you to uninstall things you only tested once and forgot or left behind.

Also about cleaning things, you should have a loot at bleachbit (open source), it would help you clean local caches

bleachbit.org/

Collapse
 
shricodev profile image
Shrijal Acharya •

Great read, @oatula. One thing that's equally important is taking time to add some malware protection to the system as well. One such package is ClamAV. You can add it to start on startup and update its virus definitions. Linux malware and viruses are increasing day by day. It's not as easily vulnerable as Windows is, but it's always safe to add one such a tool for optimizing the system.

It's not bloaty at all like Windows Defender is and completely safe to use.

Collapse
 
oatula profile image
Atul Anand Oraon •

Thanks all for your valuable insights.
I would definitely try to inculcate these advises.

Read next

utsav_sonkar profile image

Get Started with NAGIOS: Basic to Intermediate

Utsav Sonkar -

devops_descent profile image

19 Advance Linux Commands You Should Know!

DevOps Descent -

kostjapalovic profile image

Django + Celery In-depth tutorial for beginners

Kostja Appliku.com -

bytehackr profile image

Understanding the Basics of ELF Files on Linux

Sandipan Roy -