Re: tmpfs

Hello Erich and List,

good show Erich !

You will have to change your involvement to the right now in "# Copyleft
2008 Erich Titl ([email protected])" :-) !

jrb.

On Sat, Nov 9, 2024 at 9:21 AM Erich Titl <[email protected]> wrote:

> Hi Folks
>
> Am 09.11.2024 um 09:10 schrieb Andrew:
> > you may see opened deleted files by lsof:
> >
> > lsof | grep /var
> >
> > On 11/9/24 03:33, Boris via leaf-user wrote:
> >> Am 08.11.24 um 14:43 schrieb Erich Titl:
> >>> Hi Boris
> >>>
> >>> Am 08.11.2024 um 14:11 schrieb Boris via leaf-user:
> >>> ...
> >>>>>
> >>>>> My theory is that the logs occupy a lot of memory before they are
> >>>>> rotated (compressed) and this memory is not released again in the
> >>>>> tmpfs.
> >>>  >>>> I suspect that I am doing something wrong...?
> >>>>>...
>
> indeed there is something fishy. I just checked a real old piece of
> hardware with real small memory and found the following:
>
> SALT# df
> Filesystem           1K-blocks      Used Available Use% Mounted on
> tmpfs                    25600         4     25596   0% /tmp
> tmpfs                    10240      9076      1164  89% /var/log
> root                     40960     33452      7508  82% /
> /dev/sda2                51082     24370     26712  48% /mnt
>
> I the looked for a real big file in the logs, found that kernel.log
> occupies some space
>
> SALT# ls -l
> -rw-r-----    1 root     adm           1958 Nov  9 13:45 auth.log
> -rw-r-----    1 root     adm         582369 Nov  9 13:45 daemon.log
> -rw-r-----    1 root     root         67590 Oct 28 06:42 daemon.log.0.gz
> -rw-r-----    1 root     adm         107619 Nov  9 13:45 debug
> -rw-r--r--    1 root     root         16104 Oct 13 12:25 dmesg
> -rw-r-----    1 root     adm        3973250 Nov  9 13:12 kern.log
> drwxr-xr-x    2 sh-httpd adm             60 Oct 13 12:26 lighttpd
> -rw-r-----    1 root     adm              0 Nov  3 06:42 ntpd
> -rw-r-----    1 root     root         70857 Nov  3 06:42 ntpd.0.gz
> drwxr-xr-x    2 root     root           760 Nov  9 06:42 ntpstats
> -rw-------    1 root     root         49122 Oct 13 16:14 shorewall-init.log
> -rw-r--r--    1 root     root           276 Oct 13 17:32 shorewall.log
> -rw-r-----    1 root     adm              0 Nov  5 06:42 syslog
> -rw-r-----    1 root     root         67445 Nov  5 06:42 syslog.0.gz
> -rw-r-----    1 root     root        203950 Oct 30 06:42 syslog.1.gz
> -rw-r-----    1 root     root         67495 Oct 27 06:42 syslog.2.gz
> -rw-r-----    1 root     root         86871 Oct 14 06:42 syslog.3.gz
> -rw-r--r--    1 root     root             0 Oct 13 12:26 ulogd.log
> -rw-r-----    1 root     adm           2187 Nov  9 06:42 user.log
> -rw-r--r--    1 root     root         13440 Nov  9 13:45 wtmp
>
> I then looked why kern.log was not compressed and found there was no
> mention in any of the configuration files in /etc/logrotate.d
> I then added it to /etc/logrotate.d/syslog and ran logrotate.
>
> SALT# ls -l
> -rw-r-----    1 root     adm           2111 Nov  9 13:48 auth.log
> -rw-r-----    1 root     adm         582369 Nov  9 13:45 daemon.log
> -rw-r-----    1 root     root         67590 Oct 28 06:42 daemon.log.0.gz
> -rw-r-----    1 root     adm         107619 Nov  9 13:45 debug
> -rw-r--r--    1 root     root         16104 Oct 13 12:25 dmesg
> -rw-r-----    1 root     adm              0 Nov  9 13:49 kern.log
> -rw-r-----    1 root     root        397336 Nov  9 13:49 kern.log.0.gz
> drwxr-xr-x    2 sh-httpd adm             60 Oct 13 12:26 lighttpd
> -rw-r-----    1 root     adm              0 Nov  3 06:42 ntpd
> -rw-r-----    1 root     root         70857 Nov  3 06:42 ntpd.0.gz
> drwxr-xr-x    2 root     root           760 Nov  9 06:42 ntpstats
> -rw-------    1 root     root         49122 Oct 13 16:14 shorewall-init.log
> -rw-r--r--    1 root     root           276 Oct 13 17:32 shorewall.log
> -rw-r-----    1 root     adm              0 Nov  5 06:42 syslog
> -rw-r-----    1 root     root         67445 Nov  5 06:42 syslog.0.gz
> -rw-r-----    1 root     root        203950 Oct 30 06:42 syslog.1.gz
> -rw-r-----    1 root     root         67495 Oct 27 06:42 syslog.2.gz
> -rw-r-----    1 root     root         86871 Oct 14 06:42 syslog.3.gz
> -rw-r--r--    1 root     root             0 Oct 13 12:26 ulogd.log
> -rw-r-----    1 root     adm           2187 Nov  9 06:42 user.log
> -rw-r--r--    1 root     root         13824 Nov  9 13:48 wtmp
> SALT# df
> Filesystem           1K-blocks      Used Available Use% Mounted on
> tmpfs                    25600         4     25596   0% /tmp
> tmpfs                    10240      9468       772  92% /var/log
> root                     40960     33452      7508  82% /
> /dev/sda2                51082     24370     26712  48% /mnt
>
> You can see now that kern.log was compressed to about 1/10 of its
> previous size but df shows a bigger usage of /var/log. OK having very
> little log space even adding one single file may use a bit of space. I
> am still surprised by the result.
>
> Now deleting the compressed kernel log file shows:
>
> SALT# du *
> 4       auth.log
> 572     daemon.log
> 68      daemon.log.0.gz
> 108     debug
> 16      dmesg
> 0       kern.log
> 392     kern.log.0.gz
> 8       lighttpd
> 0       ntpd
> 72      ntpd.0.gz
> 196     ntpstats
> 48      shorewall-init.log
> 4       shorewall.log
> 0       syslog
> 68      syslog.0.gz
> 200     syslog.1.gz
> 68      syslog.2.gz
> 88      syslog.3.gz
> 0       ulogd.log
> 4       user.log
>
> SALT# cd /var/log ; du -s
> 1932    .
> SALT# rm kern.log.0.gz
> SALT# cd /var/log ; du -s
> 1540    .
> SALT# df
> Filesystem           1K-blocks      Used Available Use% Mounted on
> tmpfs                    25600         4     25596   0% /tmp
> tmpfs                    10240      9076      1164  89% /var/log
> root                     40960     33452      7508  82% /
> /dev/sda2                51082     24370     26712  48% /mnt
>
> So this looks a bit better. But why is daemon.log not compressed?
>
> looking for the daemon to be restarted
>
> SALT# cd /etc/logrotate.d ; grep syslog *
> ntp:DAEMON=rsyslog
> ntpd:DAEMON=syslog-ng
> syslog:LOGS_DAILY="syslog messages daemon.log cron.log auth.log debug
> kern.log"
> syslog:DAEMON=syslog-ng
>
> Mhhhh... some logrotate routines are still using syslog-ng....
> Well this is an old system with inherited (bad) settings.
>
> Changing the DAEMON parameter in all files in /etc/logrotate.d to
> rsyslog, then running logrotate results in the following:
>
> SALT# df
> Filesystem           1K-blocks      Used Available Use% Mounted on
> tmpfs                    25600         4     25596   0% /tmp
> tmpfs                    10240      2768      7472  27% /var/log
> root                     40960     33452      7508  82% /
> /dev/sda2                51082     24370     26712  48% /mnt
>
> And that is what I call success.
>
> cheers
>
> ET
>
> --
> „Wer von seinem Tag nicht zwei Drittel für sich hat, ist ein Sklave.“
> ―Friedrich Nietzsche
>
>
>
> ------------------------------------------------------------------------
> leaf-user mailing list: [email protected]
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/
>

------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/