Re: tmpfs

Hi Boris

Am 20.11.2024 um 22:03 schrieb Boris:
> Hej Erich,
> 
...

>>
>> I doubt this, in my case to clear the space a correct restart of the 
>> service was needed. 
> 
> At the risk of revealing my complete cluelessness: Which service 
> (daemon) are you restarting correctly??

There are obviously several daemons that are involved in logging and 
even some applications which do their own logging

lighttpd:DAEMON=lighttpd
ntp:DAEMON=rsyslog
shorewall:DAEMON=ulogd
syslog:DAEMON=rsyslog
ulogd:DAEMON=ulogd

So if you remove and compress a logfile the file descriptor of that file 
will be invalid in the logging application, be it an application like 
lighttpd or a network process as configured by shorewall.

So there is probably a flaw in the logrotation script, as it restarts 
the logging process only after the fact. It should probably first stop 
the logging process, then compress the affected file and only then 
restart the logging completely. In the past this appears to not have had 
much of an impact but maybe big logfiles which require more space and 
resources to compress change this.

Basically logrotate does the following

For each logfile in the configuration it determines if it needs to be 
compressed, then calls savelog to compress and rotate that file and then 
typically restarts the logging process.

I have not looked in depth into savelog believeing they do everything 
right, but here is something from the savelog script.

# Bugs: If a process is still writing to the file.0 and savelog
#       moved it to file.1 and compresses it, data could be lost.
#       Smail does not have this problem in general because it
#       restats files often.

And of course if compressing takes a long time or other resources I 
don't know what exactly happens then. We should probably look deeper 
into this.

So volunteers go for it.

cheers

ET


> 
> [snip]
> 
>>>
>>> My habit ist to reboot the box when finding it on 100%.
>>
>> Well right, this clears the memory storage.
>>
>> what you can do is play with the LOGSIZE parameter. It determines if a 
>> log gets rotated and if I am not mistaken it is in KB. Then to watch 
>> what logrotate does you can always start it like
>>
>> sh -x /usr/bin/logrotate
>>
>> You will see that savelog is used to compress and rename the file
>>
> 
> Thank you for explaining that to me.
> 
> Indeed, executing logratate without changing any parameter does eefect 
> _something_:
> 
> # df -h
> tmpfs                   800.0M    133.0M    667.0M  17% /var/log
> # sh -x /usr/bin/logrotate
> Hangup
> # df -h
> tmpfs                   800.0M    130.1M    669.9M  16% /var/log
> 
> I'll follow your hint and experiment with LOGSIZE, which now is
> # grep LOGSIZE *
> hostapd:LOGSIZE=1024
> lighttpd:LOGSIZE=1024
> ntp:LOGSIZE=4096
> pppd:LOGSIZE=1024
> shorewall:LOGSIZE=1024
> shorewall6:LOGSIZE=1024
> syslog:# NOTE: depends if LOGSIZE has been reached
> syslog:# LOGSIZE - size in kb when logrotate move and compress log files
> syslog:LOGSIZE=1024
> ulogd:LOGSIZE=1024
> 
> Thanks,
> 
> 
> Boris

-- 
„Wer von seinem Tag nicht zwei Drittel für sich hat, ist ein Sklave.“
―Friedrich Nietzsche



------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/