Re: tmpfs
Boris via leaf-user <[email protected]> Sun, 10 Nov 2024 00:26:45 +0100
| Newsgroups | gmane.linux.leaf.user |
|---|---|
| Message-ID | <[email protected]> |
Am 09.11.24 um 15:20 schrieb Erich Titl: > Hi Folks > > Am 09.11.2024 um 09:10 schrieb Andrew: >> you may see opened deleted files by lsof: >> >> lsof | grep /var >> >> On 11/9/24 03:33, Boris via leaf-user wrote: >>> Am 08.11.24 um 14:43 schrieb Erich Titl: >>>> Hi Boris >>>> >>>> Am 08.11.2024 um 14:11 schrieb Boris via leaf-user: >>>> ... >>>>>> >>>>>> My theory is that the logs occupy a lot of memory before they are >>>>>> rotated (compressed) and this memory is not released again in the >>>>>> tmpfs. >>>> >>>> I suspect that I am doing something wrong...? >>>>>> ... > > indeed there is something fishy. I just checked a real old piece of > hardware with real small memory and found the following: > > SALT# df > Filesystem 1K-blocks Used Available Use% Mounted on > tmpfs 25600 4 25596 0% /tmp > tmpfs 10240 9076 1164 89% /var/log > root 40960 33452 7508 82% / > /dev/sda2 51082 24370 26712 48% /mnt > > I the looked for a real big file in the logs, found that kernel.log > occupies some space > > SALT# ls -l > -rw-r----- 1 root adm 1958 Nov 9 13:45 auth.log > -rw-r----- 1 root adm 582369 Nov 9 13:45 daemon.log > -rw-r----- 1 root root 67590 Oct 28 06:42 daemon.log.0.gz > -rw-r----- 1 root adm 107619 Nov 9 13:45 debug > -rw-r--r-- 1 root root 16104 Oct 13 12:25 dmesg > -rw-r----- 1 root adm 3973250 Nov 9 13:12 kern.log > drwxr-xr-x 2 sh-httpd adm 60 Oct 13 12:26 lighttpd > -rw-r----- 1 root adm 0 Nov 3 06:42 ntpd > -rw-r----- 1 root root 70857 Nov 3 06:42 ntpd.0.gz > drwxr-xr-x 2 root root 760 Nov 9 06:42 ntpstats > -rw------- 1 root root 49122 Oct 13 16:14 shorewall-init.log > -rw-r--r-- 1 root root 276 Oct 13 17:32 shorewall.log > -rw-r----- 1 root adm 0 Nov 5 06:42 syslog > -rw-r----- 1 root root 67445 Nov 5 06:42 syslog.0.gz > -rw-r----- 1 root root 203950 Oct 30 06:42 syslog.1.gz > -rw-r----- 1 root root 67495 Oct 27 06:42 syslog.2.gz > -rw-r----- 1 root root 86871 Oct 14 06:42 syslog.3.gz > -rw-r--r-- 1 root root 0 Oct 13 12:26 ulogd.log > -rw-r----- 1 root adm 2187 Nov 9 06:42 user.log > -rw-r--r-- 1 root root 13440 Nov 9 13:45 wtmp > > I then looked why kern.log was not compressed and found there was no > mention in any of the configuration files in /etc/logrotate.d > I then added it to /etc/logrotate.d/syslog and ran logrotate. > > SALT# ls -l > -rw-r----- 1 root adm 2111 Nov 9 13:48 auth.log > -rw-r----- 1 root adm 582369 Nov 9 13:45 daemon.log > -rw-r----- 1 root root 67590 Oct 28 06:42 daemon.log.0.gz > -rw-r----- 1 root adm 107619 Nov 9 13:45 debug > -rw-r--r-- 1 root root 16104 Oct 13 12:25 dmesg > -rw-r----- 1 root adm 0 Nov 9 13:49 kern.log > -rw-r----- 1 root root 397336 Nov 9 13:49 kern.log.0.gz > drwxr-xr-x 2 sh-httpd adm 60 Oct 13 12:26 lighttpd > -rw-r----- 1 root adm 0 Nov 3 06:42 ntpd > -rw-r----- 1 root root 70857 Nov 3 06:42 ntpd.0.gz > drwxr-xr-x 2 root root 760 Nov 9 06:42 ntpstats > -rw------- 1 root root 49122 Oct 13 16:14 shorewall-init.log > -rw-r--r-- 1 root root 276 Oct 13 17:32 shorewall.log > -rw-r----- 1 root adm 0 Nov 5 06:42 syslog > -rw-r----- 1 root root 67445 Nov 5 06:42 syslog.0.gz > -rw-r----- 1 root root 203950 Oct 30 06:42 syslog.1.gz > -rw-r----- 1 root root 67495 Oct 27 06:42 syslog.2.gz > -rw-r----- 1 root root 86871 Oct 14 06:42 syslog.3.gz > -rw-r--r-- 1 root root 0 Oct 13 12:26 ulogd.log > -rw-r----- 1 root adm 2187 Nov 9 06:42 user.log > -rw-r--r-- 1 root root 13824 Nov 9 13:48 wtmp > SALT# df > Filesystem 1K-blocks Used Available Use% Mounted on > tmpfs 25600 4 25596 0% /tmp > tmpfs 10240 9468 772 92% /var/log > root 40960 33452 7508 82% / > /dev/sda2 51082 24370 26712 48% /mnt > > You can see now that kern.log was compressed to about 1/10 of its > previous size but df shows a bigger usage of /var/log. OK having very > little log space even adding one single file may use a bit of space. I > am still surprised by the result. > > Now deleting the compressed kernel log file shows: > > SALT# du * > 4 auth.log > 572 daemon.log > 68 daemon.log.0.gz > 108 debug > 16 dmesg > 0 kern.log > 392 kern.log.0.gz > 8 lighttpd > 0 ntpd > 72 ntpd.0.gz > 196 ntpstats > 48 shorewall-init.log > 4 shorewall.log > 0 syslog > 68 syslog.0.gz > 200 syslog.1.gz > 68 syslog.2.gz > 88 syslog.3.gz > 0 ulogd.log > 4 user.log > > SALT# cd /var/log ; du -s > 1932 . > SALT# rm kern.log.0.gz > SALT# cd /var/log ; du -s > 1540 . > SALT# df > Filesystem 1K-blocks Used Available Use% Mounted on > tmpfs 25600 4 25596 0% /tmp > tmpfs 10240 9076 1164 89% /var/log > root 40960 33452 7508 82% / > /dev/sda2 51082 24370 26712 48% /mnt > > So this looks a bit better. But why is daemon.log not compressed? > > looking for the daemon to be restarted > > SALT# cd /etc/logrotate.d ; grep syslog * > ntp:DAEMON=rsyslog > ntpd:DAEMON=syslog-ng > syslog:LOGS_DAILY="syslog messages daemon.log cron.log auth.log debug > kern.log" > syslog:DAEMON=syslog-ng > > Mhhhh... some logrotate routines are still using syslog-ng.... > Well this is an old system with inherited (bad) settings. > > Changing the DAEMON parameter in all files in /etc/logrotate.d to > rsyslog, then running logrotate results in the following: > > SALT# df > Filesystem 1K-blocks Used Available Use% Mounted on > tmpfs 25600 4 25596 0% /tmp > tmpfs 10240 2768 7472 27% /var/log > root 40960 33452 7508 82% / > /dev/sda2 51082 24370 26712 48% /mnt > > And that is what I call success. > > cheers > > ET > Hej Erich, Thank you! I did not expect that to become such a deep dive - think I need some days to follow.... Boris PS: I like your footer, but damn: I'm slave! ------------------------------------------------------------------------ leaf-user mailing list: [email protected] https://lists.sourceforge.net/lists/listinfo/leaf-user Support Request -- http://leaf-project.org/