Hello,
I've the same problem since my install of armbian on a new Odroid-HC4 in December/January : the same daily mail message from armbian-truncate-logs, the log size that seems to be quite enough (even increased from 50Mo to 250Mo), and during the day a log size quite low (around 10/15% of total /var/log/ size, command "df /var/log/ --output=pcent | tail -1 |cut -d "%" -f 1"), until around midnight where size explodes
I've also spent time to investigate, and I think the problem is related to journalctl and/or sysstat. Here are some clues i've found.
journalctl : I don't understand it well, but I have often corrupted files when I used "journalctl --verify", and maybe logrotate and/or armbian-truncate-logs don't manage well for journalctl ? ...
sysstat : I didn't know sysstat before, it is used to record the system resources usage (IO, memory, ...). On my system it runs every ten minutes. And it is called again at 23:59 to "rotate statistics file", cf /etc/cron.d/sysstat :
Maybe the data are somewhere else (where?), and it tries to write them in /var/log/sysstat on midnight for the last day which has just been over ?
yesterday, I noted that at 00:00, /var/log/journal size went suddenly from 10/20Mo to 215Mo (!), and there were a lot of corrupted files.
on my (sys)log, a task which may be strongly related to this issue is logrotate (there are not other entry at 00:00 which should be linked to this problem, I don't think it is "man-db regeneration") :
Any idea ? I don't know what I can do in addition to that.
Thanks
Olinn
