# /var/log/messages full **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [January 23, 2020, 10:47am UTC](https://community.graylog.org/t/var-log-messages-full/13588 "2020-01-23T10:47:46Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 10:47am UTC](https://community.graylog.org/t/var-log-messages-full/13588/1 "2020-01-23T10:47:46Z")
Hello guys, after installing graylog, I therefore created TCP inputs with syslog to receive logs on my web interface. It worked but my / var / log / messages files completely saturated my storage space (50GB) in the space of 5 minutes, which made it impossible to start the Elasticsearch and Mongodb service and access to the Graylog web interface. I therefore deleted the content of the “messages” file which made it possible to resolve the various problems above. So my question is: how to avoid this overload? Do I have to establish rules in the Graylog configuration file? Thank you in advance. ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 11:07am UTC](https://community.graylog.org/t/var-log-messages-full/13588/2 "2020-01-23T11:07:25Z")
What exactly was filling up `/var/log/messages` ? Graylog stores messages it receives in Elasticsearch so, syslog messages you were sending from remote hosts should be written there and not `/var/log/messages`. Please provide a full description of your configuration. How did you configure the syslog inputs? How were you sending the syslog messages to your Graylog server? ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 12:57pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/3 "2020-01-23T12:57:12Z")
Hello Ponet, thank you for your reply. Here are some lines from the message file. For my configuration, I therefore have a Centos 7 VM, 4 GB RAM, 100 GB of storage. For the input I configured it in TCP on port 1514 with as bind address 127.0.0.1. Sorry for the limited information I cannot currently access my web interface. ![messages](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a427a81af4a0249eaddf172e8ee7584ac06adde5.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 1:11pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/4 "2020-01-23T13:11:07Z")
You’ve bound the input to the loop-back address so, are you just using it for local syslog messages on the graylog host? ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 1:20pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/5 "2020-01-23T13:20:58Z")
On the Graylog Host, and another client (local) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 2:28pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/6 "2020-01-23T14:28:50Z")
> [@VrnGray](#): > > another client (local) What do you mean? Please explain the situation. Without knowing how you are configuring your setup, it’s hard to work out what is wrong. ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 2:49pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/8 "2020-01-23T14:49:51Z")
Yes sorry for that, the problem comes from my input apparently. When I start this input, the “messages” file fills up again. I put you the configuration of my input and my rsyslog. How can I receive the logs from my greylog server on the web interface without filling this “messages” folder? Thank you and sorry again for the cruel lack of precision. ![input](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/271395a9b7eb529f398468492bae8a202d1f604b.png) ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 2:50pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/9 "2020-01-23T14:50:32Z")
![rsyslog](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b7586ace2b2914b1e1ac5440e4b85751de61f4f2.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 2:57pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/10 "2020-01-23T14:57:12Z")
The screenshot of `/var/log/messages` that you posted earlier, was that screenshot take after you had deleted the file? If the screenshot is from after deleting the file, can you start the syslog input briefly to capture some of the messages that are flooding the log? What is the last screenshot you posted? It looks like your rsyslog configuration however, everything is commented out and it looks like it is just pasted into a terminal? ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 3:09pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/11 "2020-01-23T15:09:12Z")
No before deleting, yes the last screenshot is my rsyslog, I recommented the line \*. \* To avoid the flood in the / var / log / messages because as soon as I uncomment this line the file is filled. An exemple of my “messages” file after uncomment the line in the rsyslog.conf > an 23 16:02:46 graylog systemd Starting System Logging Service… > Jan 23 16:02:46 graylog rsyslogd [origin software=“rsyslogd” swVersion=“8.24.0-41.el7\_7.2” x-pid=“1961” x-info=“[http://www.rsyslog.com](http://www.rsyslog.com)”] start > Jan 23 16:02:46 graylog systemd Started System Logging Service. > Jan 23 16:02:46 graylog systemd Stopping System Logging Service… > Jan 23 16:02:46 graylog rsyslogd [origin software=“rsyslogd” swVersion=“8.24.0-41.el7\_7.2” x-pid=“1166” x-info=“[http://www.rsyslog.com](http://www.rsyslog.com)”] exiting on signal 15. ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 3:11pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/12 "2020-01-23T15:11:45Z")
OK so, from looking at it, your rsyslog config looks to be wrong. You are running your syslog input on 127.0.0.1:1514 however, you have configured rsyslog to send to 127.0.0.1:514 ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 3:21pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/13 "2020-01-23T15:21:57Z")
You’re right, thanks. After changing the port, the message file is no longer flooded but I still cannot get the graylog server logs on my web interface. How can I do ? ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 3:26pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/14 "2020-01-23T15:26:30Z")
Yeah, I think you unintentionally created a feedback loop with rsyslog since it was configured to send everything back to itself so, it just continuously wrote until you ran out of disk space… If your input is running and rsyslog is sending to it, you should start to see the messages appear. Check the sources page or ‘View received messages’ on the syslog input. ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 3:31pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/15 "2020-01-23T15:31:06Z")
Nothing appears, is this configuration correct? ![input](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/271395a9b7eb529f398468492bae8a202d1f604b.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 3:33pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/16 "2020-01-23T15:33:14Z")
You might want to start the input. It can’t receive messages if it isn’t listening for them. ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 3:34pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/17 "2020-01-23T15:34:38Z")
I activated it well before trying, don’t worry. Still nothing. ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 3:36pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/18 "2020-01-23T15:36:18Z")
Run tcpdump and check to see if rsyslog is definitely sending to 127.0.0.1:1514 ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 3:45pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/19 "2020-01-23T15:45:15Z")
Tcpdump did not work, 0 packet captured. Port 1514 is open on my firewall, do you have an idea? ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 23, 2020, 3:50pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/20 "2020-01-23T15:50:03Z")
Just want to confirm, you were running tcpdump on the loopback interface, right? ---
**Author:** ![VrnGray](https://avatars.discourse-cdn.com/v4/letter/v/ce73a5/32.png) [@VrnGray](https://community.graylog.org/u/VrnGray)\ **Post date:** [January 23, 2020, 3:56pm UTC](https://community.graylog.org/t/var-log-messages-full/13588/21 "2020-01-23T15:56:37Z")
tcpdump -ni lo port 514 am i right ? [Next page](https://community.graylog.org/t/var-log-messages-full/13588.md?page=2)