LXC Debian 10 disk growing out of control

I built several LXC antlets using the Debian 10 template. Initial size was around 750-900 MB depending on what extras I installed.  I set the max disk size around 5GB as these were to be static very lightweight webservers that host one site and very few basic pages in HTML only.

Most of these were built in Aug or Sept 2020.  In October of the antlets were in the 900MB to 1.75GB size range. Today they are all over the 5GB limit I set and unresponsive as antMan reports disk quota exceeded. I cannot even change the size of the disk because of the same error.

Since there have been absolutely ZERO changes to the antlets, I restored them all from backup dated Oct 3.  The sizes are back down to 1.75GB max.

So why are these antlets growing by 3-4GB in a little over 30 days?

I have 2 antlets created from the same template in the test environment that have been turned off during the last month and when booted, the size has not increased (as it should be) but it tells me what the size should be for the live servers.

Hi spollock:

I'm not sure what could be causing these grow so much.

You could run these command within the antlet to see what's taking up space:

apt install ncdu

ncdu /

Hi thanks for the reply...

/var/log/wtmp is growing exponentially it seems.  over 5gb on most of my webservers that use the Debian 10 LXC template

After manually removing the wtmp file... back down to where it should be.

Hi spollock:

Thanks for sharing your results.  Glad to hear it's working!

Actually... I don't consider this a fix.  Something in your template is off, which is the root cause.

Band-Aids are not a long term fix.

Hi Stephen:

Thanks for letting us know.

You can check the contents of the /var/log/wtmp directory with this command:

last -i

This will show all logins and boot times.

You can also create a logrotate.conf file like this (see below):

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
compress# packages drop log rotation information into this directory
include /etc/logrotate.d# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
  minsize 1M
    rotate 1
}
/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

Please let us know how it goes.

Thanks.