Re: tmpfs

Am 09.11.24 um 15:20 schrieb Erich Titl:
> Hi Folks
> 
> Am 09.11.2024 um 09:10 schrieb Andrew:
>> you may see opened deleted files by lsof:
>>
>> lsof | grep /var
>>
>> On 11/9/24 03:33, Boris via leaf-user wrote:
>>> Am 08.11.24 um 14:43 schrieb Erich Titl:
>>>> Hi Boris
>>>>
>>>> Am 08.11.2024 um 14:11 schrieb Boris via leaf-user:
>>>> ...
>>>>>>
>>>>>> My theory is that the logs occupy a lot of memory before they are 
>>>>>> rotated (compressed) and this memory is not released again in the 
>>>>>> tmpfs.
>>>>  >>>> I suspect that I am doing something wrong...?
>>>>>> ...
> 
> indeed there is something fishy. I just checked a real old piece of 
> hardware with real small memory and found the following:
> 
> SALT# df
> Filesystem           1K-blocks      Used Available Use% Mounted on
> tmpfs                    25600         4     25596   0% /tmp
> tmpfs                    10240      9076      1164  89% /var/log
> root                     40960     33452      7508  82% /
> /dev/sda2                51082     24370     26712  48% /mnt
> 
> I the looked for a real big file in the logs, found that kernel.log 
> occupies some space
> 
> SALT# ls -l
> -rw-r-----    1 root     adm           1958 Nov  9 13:45 auth.log
> -rw-r-----    1 root     adm         582369 Nov  9 13:45 daemon.log
> -rw-r-----    1 root     root         67590 Oct 28 06:42 daemon.log.0.gz
> -rw-r-----    1 root     adm         107619 Nov  9 13:45 debug
> -rw-r--r--    1 root     root         16104 Oct 13 12:25 dmesg
> -rw-r-----    1 root     adm        3973250 Nov  9 13:12 kern.log
> drwxr-xr-x    2 sh-httpd adm             60 Oct 13 12:26 lighttpd
> -rw-r-----    1 root     adm              0 Nov  3 06:42 ntpd
> -rw-r-----    1 root     root         70857 Nov  3 06:42 ntpd.0.gz
> drwxr-xr-x    2 root     root           760 Nov  9 06:42 ntpstats
> -rw-------    1 root     root         49122 Oct 13 16:14 shorewall-init.log
> -rw-r--r--    1 root     root           276 Oct 13 17:32 shorewall.log
> -rw-r-----    1 root     adm              0 Nov  5 06:42 syslog
> -rw-r-----    1 root     root         67445 Nov  5 06:42 syslog.0.gz
> -rw-r-----    1 root     root        203950 Oct 30 06:42 syslog.1.gz
> -rw-r-----    1 root     root         67495 Oct 27 06:42 syslog.2.gz
> -rw-r-----    1 root     root         86871 Oct 14 06:42 syslog.3.gz
> -rw-r--r--    1 root     root             0 Oct 13 12:26 ulogd.log
> -rw-r-----    1 root     adm           2187 Nov  9 06:42 user.log
> -rw-r--r--    1 root     root         13440 Nov  9 13:45 wtmp
> 
> I then looked why kern.log was not compressed and found there was no 
> mention in any of the configuration files in /etc/logrotate.d
> I then added it to /etc/logrotate.d/syslog and ran logrotate.
> 
> SALT# ls -l
> -rw-r-----    1 root     adm           2111 Nov  9 13:48 auth.log
> -rw-r-----    1 root     adm         582369 Nov  9 13:45 daemon.log
> -rw-r-----    1 root     root         67590 Oct 28 06:42 daemon.log.0.gz
> -rw-r-----    1 root     adm         107619 Nov  9 13:45 debug
> -rw-r--r--    1 root     root         16104 Oct 13 12:25 dmesg
> -rw-r-----    1 root     adm              0 Nov  9 13:49 kern.log
> -rw-r-----    1 root     root        397336 Nov  9 13:49 kern.log.0.gz
> drwxr-xr-x    2 sh-httpd adm             60 Oct 13 12:26 lighttpd
> -rw-r-----    1 root     adm              0 Nov  3 06:42 ntpd
> -rw-r-----    1 root     root         70857 Nov  3 06:42 ntpd.0.gz
> drwxr-xr-x    2 root     root           760 Nov  9 06:42 ntpstats
> -rw-------    1 root     root         49122 Oct 13 16:14 shorewall-init.log
> -rw-r--r--    1 root     root           276 Oct 13 17:32 shorewall.log
> -rw-r-----    1 root     adm              0 Nov  5 06:42 syslog
> -rw-r-----    1 root     root         67445 Nov  5 06:42 syslog.0.gz
> -rw-r-----    1 root     root        203950 Oct 30 06:42 syslog.1.gz
> -rw-r-----    1 root     root         67495 Oct 27 06:42 syslog.2.gz
> -rw-r-----    1 root     root         86871 Oct 14 06:42 syslog.3.gz
> -rw-r--r--    1 root     root             0 Oct 13 12:26 ulogd.log
> -rw-r-----    1 root     adm           2187 Nov  9 06:42 user.log
> -rw-r--r--    1 root     root         13824 Nov  9 13:48 wtmp
> SALT# df
> Filesystem           1K-blocks      Used Available Use% Mounted on
> tmpfs                    25600         4     25596   0% /tmp
> tmpfs                    10240      9468       772  92% /var/log
> root                     40960     33452      7508  82% /
> /dev/sda2                51082     24370     26712  48% /mnt
> 
> You can see now that kern.log was compressed to about 1/10 of its 
> previous size but df shows a bigger usage of /var/log. OK having very 
> little log space even adding one single file may use a bit of space. I 
> am still surprised by the result.
> 
> Now deleting the compressed kernel log file shows:
> 
> SALT# du *
> 4       auth.log
> 572     daemon.log
> 68      daemon.log.0.gz
> 108     debug
> 16      dmesg
> 0       kern.log
> 392     kern.log.0.gz
> 8       lighttpd
> 0       ntpd
> 72      ntpd.0.gz
> 196     ntpstats
> 48      shorewall-init.log
> 4       shorewall.log
> 0       syslog
> 68      syslog.0.gz
> 200     syslog.1.gz
> 68      syslog.2.gz
> 88      syslog.3.gz
> 0       ulogd.log
> 4       user.log
> 
> SALT# cd /var/log ; du -s
> 1932    .
> SALT# rm kern.log.0.gz
> SALT# cd /var/log ; du -s
> 1540    .
> SALT# df
> Filesystem           1K-blocks      Used Available Use% Mounted on
> tmpfs                    25600         4     25596   0% /tmp
> tmpfs                    10240      9076      1164  89% /var/log
> root                     40960     33452      7508  82% /
> /dev/sda2                51082     24370     26712  48% /mnt
> 
> So this looks a bit better. But why is daemon.log not compressed?
> 
> looking for the daemon to be restarted
> 
> SALT# cd /etc/logrotate.d ; grep syslog *
> ntp:DAEMON=rsyslog
> ntpd:DAEMON=syslog-ng
> syslog:LOGS_DAILY="syslog messages daemon.log cron.log auth.log debug 
> kern.log"
> syslog:DAEMON=syslog-ng
> 
> Mhhhh... some logrotate routines are still using syslog-ng....
> Well this is an old system with inherited (bad) settings.
> 
> Changing the DAEMON parameter in all files in /etc/logrotate.d to 
> rsyslog, then running logrotate results in the following:
> 
> SALT# df
> Filesystem           1K-blocks      Used Available Use% Mounted on
> tmpfs                    25600         4     25596   0% /tmp
> tmpfs                    10240      2768      7472  27% /var/log
> root                     40960     33452      7508  82% /
> /dev/sda2                51082     24370     26712  48% /mnt
> 
> And that is what I call success.
> 
> cheers
> 
> ET
> 

Hej Erich,

first let me thank you once more.
Second I have to admit that I am not very familiar with this corner of 
configuration.

I understood that ker.log should be part of the logrotate-process. So I 
added kern.log to /etc/logrotate.d/syslog and ran logrotate. That does 
not make any change to /var/log, because kern.log is quite small here:

# l
[snip]
-rw-r-----    1 root     adm          54682 Nov 11 08:41 kern.log

Furthermore, I looked for syslog-ng in any of the logrote-configs in
/etc/logrotate.d but did not find it:

# pwd
/etc/logrotate.d
nordgate5# grep syslog *
ntp:DAEMON=rsyslog
pppd:DAEMON=rsyslog
syslog:LOGS_DAILY="syslog daemon.log cron.log auth.log user.log debug 
ppp.log kern.log"
syslog:DAEMON=rsyslog

So I cannot share your success unfortunately.

But during that closer look to the log environment, I found there is 
another daemon running: ulogd

# ps | grep log
  1847 root     13044 S    /usr/sbin/rsyslogd
  2617 root      1408 S    grep log
  3250 root      6992 S    /usr/sbin/hostapd -B -P /var/run/hostapd.pid 
-dd -t -f /var/log/hostapd.log /etc/hostapd/hostapd.conf
  3268 root      1816 S<   /usr/sbin/ulogd -d

But that seems OK as well.

So I'm again awaiting the 100% usage of /var/log that might happen in 
the middle of January '25 with the 800 MB setting. ;-)

Thanks,

Boris



------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/