Re: tmpfs
Erich Titl <[email protected]> Sat, 9 Nov 2024 15:20:04 +0100
| Newsgroups | gmane.linux.leaf.user |
|---|---|
| Message-ID | <[email protected]> |
Hi Folks Am 09.11.2024 um 09:10 schrieb Andrew: > you may see opened deleted files by lsof: > > lsof | grep /var > > On 11/9/24 03:33, Boris via leaf-user wrote: >> Am 08.11.24 um 14:43 schrieb Erich Titl: >>> Hi Boris >>> >>> Am 08.11.2024 um 14:11 schrieb Boris via leaf-user: >>> ... >>>>> >>>>> My theory is that the logs occupy a lot of memory before they are >>>>> rotated (compressed) and this memory is not released again in the >>>>> tmpfs. >>> >>>> I suspect that I am doing something wrong...? >>>>>... indeed there is something fishy. I just checked a real old piece of hardware with real small memory and found the following: SALT# df Filesystem 1K-blocks Used Available Use% Mounted on tmpfs 25600 4 25596 0% /tmp tmpfs 10240 9076 1164 89% /var/log root 40960 33452 7508 82% / /dev/sda2 51082 24370 26712 48% /mnt I the looked for a real big file in the logs, found that kernel.log occupies some space SALT# ls -l -rw-r----- 1 root adm 1958 Nov 9 13:45 auth.log -rw-r----- 1 root adm 582369 Nov 9 13:45 daemon.log -rw-r----- 1 root root 67590 Oct 28 06:42 daemon.log.0.gz -rw-r----- 1 root adm 107619 Nov 9 13:45 debug -rw-r--r-- 1 root root 16104 Oct 13 12:25 dmesg -rw-r----- 1 root adm 3973250 Nov 9 13:12 kern.log drwxr-xr-x 2 sh-httpd adm 60 Oct 13 12:26 lighttpd -rw-r----- 1 root adm 0 Nov 3 06:42 ntpd -rw-r----- 1 root root 70857 Nov 3 06:42 ntpd.0.gz drwxr-xr-x 2 root root 760 Nov 9 06:42 ntpstats -rw------- 1 root root 49122 Oct 13 16:14 shorewall-init.log -rw-r--r-- 1 root root 276 Oct 13 17:32 shorewall.log -rw-r----- 1 root adm 0 Nov 5 06:42 syslog -rw-r----- 1 root root 67445 Nov 5 06:42 syslog.0.gz -rw-r----- 1 root root 203950 Oct 30 06:42 syslog.1.gz -rw-r----- 1 root root 67495 Oct 27 06:42 syslog.2.gz -rw-r----- 1 root root 86871 Oct 14 06:42 syslog.3.gz -rw-r--r-- 1 root root 0 Oct 13 12:26 ulogd.log -rw-r----- 1 root adm 2187 Nov 9 06:42 user.log -rw-r--r-- 1 root root 13440 Nov 9 13:45 wtmp I then looked why kern.log was not compressed and found there was no mention in any of the configuration files in /etc/logrotate.d I then added it to /etc/logrotate.d/syslog and ran logrotate. SALT# ls -l -rw-r----- 1 root adm 2111 Nov 9 13:48 auth.log -rw-r----- 1 root adm 582369 Nov 9 13:45 daemon.log -rw-r----- 1 root root 67590 Oct 28 06:42 daemon.log.0.gz -rw-r----- 1 root adm 107619 Nov 9 13:45 debug -rw-r--r-- 1 root root 16104 Oct 13 12:25 dmesg -rw-r----- 1 root adm 0 Nov 9 13:49 kern.log -rw-r----- 1 root root 397336 Nov 9 13:49 kern.log.0.gz drwxr-xr-x 2 sh-httpd adm 60 Oct 13 12:26 lighttpd -rw-r----- 1 root adm 0 Nov 3 06:42 ntpd -rw-r----- 1 root root 70857 Nov 3 06:42 ntpd.0.gz drwxr-xr-x 2 root root 760 Nov 9 06:42 ntpstats -rw------- 1 root root 49122 Oct 13 16:14 shorewall-init.log -rw-r--r-- 1 root root 276 Oct 13 17:32 shorewall.log -rw-r----- 1 root adm 0 Nov 5 06:42 syslog -rw-r----- 1 root root 67445 Nov 5 06:42 syslog.0.gz -rw-r----- 1 root root 203950 Oct 30 06:42 syslog.1.gz -rw-r----- 1 root root 67495 Oct 27 06:42 syslog.2.gz -rw-r----- 1 root root 86871 Oct 14 06:42 syslog.3.gz -rw-r--r-- 1 root root 0 Oct 13 12:26 ulogd.log -rw-r----- 1 root adm 2187 Nov 9 06:42 user.log -rw-r--r-- 1 root root 13824 Nov 9 13:48 wtmp SALT# df Filesystem 1K-blocks Used Available Use% Mounted on tmpfs 25600 4 25596 0% /tmp tmpfs 10240 9468 772 92% /var/log root 40960 33452 7508 82% / /dev/sda2 51082 24370 26712 48% /mnt You can see now that kern.log was compressed to about 1/10 of its previous size but df shows a bigger usage of /var/log. OK having very little log space even adding one single file may use a bit of space. I am still surprised by the result. Now deleting the compressed kernel log file shows: SALT# du * 4 auth.log 572 daemon.log 68 daemon.log.0.gz 108 debug 16 dmesg 0 kern.log 392 kern.log.0.gz 8 lighttpd 0 ntpd 72 ntpd.0.gz 196 ntpstats 48 shorewall-init.log 4 shorewall.log 0 syslog 68 syslog.0.gz 200 syslog.1.gz 68 syslog.2.gz 88 syslog.3.gz 0 ulogd.log 4 user.log SALT# cd /var/log ; du -s 1932 . SALT# rm kern.log.0.gz SALT# cd /var/log ; du -s 1540 . SALT# df Filesystem 1K-blocks Used Available Use% Mounted on tmpfs 25600 4 25596 0% /tmp tmpfs 10240 9076 1164 89% /var/log root 40960 33452 7508 82% / /dev/sda2 51082 24370 26712 48% /mnt So this looks a bit better. But why is daemon.log not compressed? looking for the daemon to be restarted SALT# cd /etc/logrotate.d ; grep syslog * ntp:DAEMON=rsyslog ntpd:DAEMON=syslog-ng syslog:LOGS_DAILY="syslog messages daemon.log cron.log auth.log debug kern.log" syslog:DAEMON=syslog-ng Mhhhh... some logrotate routines are still using syslog-ng.... Well this is an old system with inherited (bad) settings. Changing the DAEMON parameter in all files in /etc/logrotate.d to rsyslog, then running logrotate results in the following: SALT# df Filesystem 1K-blocks Used Available Use% Mounted on tmpfs 25600 4 25596 0% /tmp tmpfs 10240 2768 7472 27% /var/log root 40960 33452 7508 82% / /dev/sda2 51082 24370 26712 48% /mnt And that is what I call success. cheers ET -- „Wer von seinem Tag nicht zwei Drittel für sich hat, ist ein Sklave.“ ―Friedrich Nietzsche ------------------------------------------------------------------------ leaf-user mailing list: [email protected] https://lists.sourceforge.net/lists/listinfo/leaf-user Support Request -- http://leaf-project.org/