Re: tmpfs

Hej Erich,

Am 12.11.24 um 16:30 schrieb Erich Titl:
> Hi Boris
> 
> I wrote the last message on a notepad sitting in a bar, 

sounds like not accepting to live like a slave :-)

> no having access > to my system may lead to errors.
> 
> 
> 
>      I am not a big fan of multiple logging services so take this with a
>      grain of salt. Basically the logging service used by the various
>      daemons depend on the configuration of each of those services. Most
>      things in Linux can log to rsyslog. To distinguish these logs is a
>      feature of rsyslog and needs to be configured there.
> 
> So these are the logrotate targets I have
> 
> SALT# ls
> lighttpd   ntp        ntpd       shorewall  syslog     ulogd
> 
> SALT# grep DAEMON *
> lighttpd:DAEMON=adm
> lighttpd:DAEMON=lighttpd
> ntp:DAEMON=rsyslog
> ntpd:DAEMON=rsyslog
> shorewall:DAEMON=ulogd
> syslog:DAEMON=rsyslog
> ulogd:DAEMON=ulogd

So the diffrences between yours an mine is only in hostapd.

> 
> So lets look at these
> 
> lighttpd:DAEMON=adm
> lighttpd:DAEMON=lighttpd
> 
> lighttpd has its own logging stuff. It can log to syslog which IMHO 
> would be the best to do. I have not seen a way to assign this log a 
> separate log facility though.
> 
> There is, to my knowledge, no service called adm. I have no clue where 
> this comes from, and then the second assignment of DAEMON will overwrite 
> the first, this is useless.

OK, there might be a misconfiguration, but that doesn't seem to explode 
the size on my router. I don't use the webfrontend and the log files are 
very small:

drwxr-xr-x    2 sh-httpd adm             80 Nov  9 02:28 .
drwxr-xr-x    4 root     root           620 Nov 19 06:42 ..
-rw-r--r--    1 sh-httpd adm              0 Nov  9 02:28 access.log
-rw-r--r--    1 sh-httpd adm           2091 Nov 19 06:42 error.log

> 
> ntp:DAEMON=rsyslog
> ntpd:DAEMON=rsyslog
> 
> SALT# diff ntp ntpd
> --- ntp
> +++ ntpd
> @@ -1,5 +1,5 @@
>   LOGS_WEEKLY="ntpd"
> -LOGSIZE=4096
> +LOGSIZE=512
>   DAEMON=rsyslog
>   METHOD=restart
>   COMPRESS_ALL=1
> 
> These two logrotate entries make no sense. They refer to the same set of 
> logfiles, the same frequency of logrotate, just with a different log size.
> 
> I don't know why we have two sets of these. I found thet in ntp.lrp 
> there is only mention of /etc/logrotate.d/ntp. So I guess you can easily 
> drop the ntpd configuration from /etc/logrotate.d. It may be there for 
> historical reasons only. I am running the fully blown ntpd and not the 
> one that comes with busysbox, so this may explain the difference.

Mmhh, OK, I found daily gzipped logs (loopstat and peerstat) in 
/var/log/ntpstats:

# l
drwxr-xr-x    2 root     root           720 Nov 19 06:42 .
drwxr-xr-x    4 root     root           620 Nov 19 06:42 ..
-rw-r--r--    1 root     root          1304 Nov 19 07:37 loopstats
-rw-r--r--    1 root     root           284 Nov 12 06:42 
loopstats.20241112.gz
-rw-r--r--    1 root     root           249 Nov 13 06:42 
loopstats.20241113.gz
......
-rw-r--r--    1 root     root          2174 Nov 19 07:37 peerstats
-rw-r--r--    1 root     root           522 Nov 12 06:42 
peerstats.20241112.gz
-rw-r--r--    1 root     root           409 Nov 13 06:42 
peerstats.20241113.gz
.......

I will monitor that for longer time. But with a look at the size of 
those files, I doubt here is the reason for running out of tmpfs space 
(500 MB)

> Shorewall is logging to ulog, and ulogd does not really log much and can 
> easily be just left as is.
> 
> hostapd AFAIK can only log to syslog or stdout ( and this only if it 
> does not fork to background )

hostapd doesn't make much noise:
-rw-r-----    1 root     adm              0 Nov  9 06:42 hostapd.log
-rw-r-----    1 root     root        113904 Nov  9 06:42 hostapd.log.0.gz

> 
> In my settings I have not defined a separate syslog file for hostapd so 
> it just goes to syslog. But if you have you can handle the rotation in 
> the syslog configuration in /etc/logrotate.d or if you prefer write you 
> own config file.
> 
> Hope this clears the fog a little. (Un)fortunately we have a very 
> flexible system where small changes on one end may have dependencies 
> where you might not expect them. So check
> 
> - what services write logs and where
> - do the logfiles need to be rotated
> - are these logfiles referenced somewhere in the logrotate configuration
> 
> Find out which file grows unexpectedly fast. It might be a good idea to 
> start there.

OK, let me see:

Right now, df -h shows
tmpfs                   800.0M    121.0M    679.0M  15% /var/log
121MB are being told as used.

du -h /var/log shows
140.0K	/var/log/ntpstats
4.0K	/var/log/lighttpd
8.4M	/var/log/

Just for fun I uncompress all gz-files in var/log and subdirs and get
308.0K	/var/log/ntpstats
4.0K	/var/log/lighttpd
36.0M	/var/log/

shorewall.log and auth.log take the biggest part of the volume with 
aproximately 25 MB while being rotated (kept) 4 days.

So, if there are 36 MB logged (and compressed) in 4 days and the box ia 
up for 10 days, we don't even reach the 121 MB from df .

Funny, isn't it?

With the uncompressed logs, df -h shows
tmpfs                   800.0M    149.0M    651.0M  19% /var/log

For me it smells like tmpfs does not release former occupied storage 
after logrotating.

And no - no SSD on my box. To be honest I forgot the details aof the 
hardware. ;-) But I'm shure there is no SSD.

My habit ist to reboot the box when finding it on 100%.

So far. Thanks for spending thoughts to this.


Boris


------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/