Ah, logs. All gone.

Should it be? Can someone please explain to me the structure of the guruplug? I have this after df


Filesystem           1K-blocks      Used Available Use% Mounted on
tmpfs                   256716         0    256716   0% /lib/init/rw
udev                     10240       688      9552   7% /dev
tmpfs                   256716         4    256712   1% /dev/shm
rootfs                  473204    467984      5220  99% /
tmpfs                   256716     21032    235684   9% /var/cache/apt

I have barely used the thing and it looks as if the rootfs is full.  Any tips or pointers? things to read? should i  be unslinging to usb? Any help would be greatly appreciated.  Ta!