/var/log on zram0


dvachon
 Share

2 2

Recommended Posts

Hello, running  ARMBIAN 5.59 stable Debian GNU/Linux 9 (stretch) 4.14.65-sunxi on Banana Pi pro

/var/log is always full

df -h

/dev/zram0       49M   48M     0 100% /var/log

 

root@mail:/etc# zramctl
NAME       ALGORITHM DISKSIZE  DATA COMPR TOTAL STREAMS MOUNTPOINT
/dev/zram0 lz4            50M 47.5M  7.8M  8.4M       2 /var/log
/dev/zram1 lz4         249.7M    4K   63B    4K       2 [SWAP]
/dev/zram2 lz4         249.7M    4K   61B    4K       2 [SWAP]
 

Since i am running on sata (ssd of 128gig) i dont need that. Cannot find how to stop the mount of /var/log on /dev/zram0. Not in fstab. Want to use the real /var/log from / (root).

 

 

Link to post
Share on other sites

Donate and support the project!

5 hours ago, dvachon said:

Hello, running  ARMBIAN 5.59 stable Debian GNU/Linux 9 (stretch) 4.14.65-sunxi on Banana Pi pro

/var/log is always full

df -h

/dev/zram0       49M   48M     0 100% /var/log

 

You can disable logging to ram by setting `ENABLED=false´ in  `/etc/default/armbian-ramlog´.

Link to post
Share on other sites

21 hours ago, dvachon said:

Since i am running on sata (ssd of 128gig) i dont need that. Cannot find how to stop the mount of /var/log on /dev/zram0. Not in fstab. Want to use the real /var/log from / (root).

How to disable it correctly:

Only config edit will not give you correct effect.

Link to post
Share on other sites

I'm experimenting the same issue with a lot of devices, the 50Mo get filled up very quickly. Most of the time, nginx logs are responsible of that, but also hostapd in some case the wifi dongle is not present.

 

This is very very annoying as the server can not work properly after the log folder is full. The only way is to move/remove files.

 

I removed log2ram, but as I understand zram does the same !!

 

 

Link to post
Share on other sites

Hi martinayotte

On 11/20/2018 at 9:01 PM, martinayotte said:

Another possible workaround is to have a "crontab" job that delete or truncate files regularly ...

 

On var/log and var/log/.hdd : Done that, every hour, it works, obviously :-) .

also using sed to remove the "IR event FIFO is full" lines

 

But now, for a while or perhaps since then, my warning system, based on what df under /var/log reports gives false warnings : df misreports the real size

 

eg : in WinSCP, the calculate button says 2.2MB, where df says 75% of 50MB


Perhaps the varlog scripts are not happy with the delete/modify ?

 

Reboot repairs the mismatch

 

Edit :

Moved to using du iso df, du is reporting correctly.

 

so that is solved, but perhaps a point of attention for the developers ?

 

 

 

Link to post
Share on other sites

Hello!

How could it be? zram is full, but /var/log is empty.

I think this happened when once the log was full and I deleted a large file.

How to fix it without rebooting?

 

========================================================================================

root@hms:/var# uname -a
Linux hms 4.19.20-sunxi #5.75 SMP Sat Feb 9 19:02:47 CET 2019 armv7l armv7l armv7l GNU/Linux


root@hms:/var# zramctl
NAME       ALGORITHM DISKSIZE  DATA COMPR TOTAL STREAMS MOUNTPOINT
/dev/zram4 lzo         121,1M    4K   78B   12K       4 [SWAP]
/dev/zram3 lzo         121,1M    4K   78B   12K       4 [SWAP]
/dev/zram2 lzo         121,1M    4K   78B   12K       4 [SWAP]
/dev/zram1 lzo         121,1M    4K   78B   12K       4 [SWAP]
/dev/zram0                50M 43,8M  7,8M  8,7M       4 /var/log

 

root@hms:/var# df /var/log
Filesystem     1K-blocks  Used Available Use% Mounted on
/dev/zram0         49584 44780      1220  98% /var/log
 

root@hms:/var# du -k /var/log
12    /var/log/motion
4    /var/log/samba/cores/winbindd
4    /var/log/samba/cores/smbd
4    /var/log/samba/cores/nmbd
16    /var/log/samba/cores
28    /var/log/samba
4    /var/log/apache2
4    /var/log/apt
4    /var/log/unattended-upgrades
56    /var/log
 

Link to post
Share on other sites

Got it. Looks like a bug

lsof | grep /var/log

......

rsyslogd   1051                syslog    7w      REG      254,0    18268         29 /var/log/syslog (deleted)
rsyslogd   1051                syslog    8w      REG      254,0        0         26 /var/log/kern.log (deleted)
rsyslogd   1051                syslog    9w      REG      254,0 44234481         22 /var/log/auth.log (deleted)
in:imuxso  1051  1811          syslog    7w      REG      254,0    18268         29 /var/log/syslog (deleted)
in:imuxso  1051  1811          syslog    8w      REG      254,0        0         26 /var/log/kern.log (deleted)
in:imuxso  1051  1811          syslog    9w      REG      254,0 44234481         22 /var/log/auth.log (deleted)
in:imklog  1051  1812          syslog    7w      REG      254,0    18268         29 /var/log/syslog (deleted)
in:imklog  1051  1812          syslog    8w      REG      254,0        0         26 /var/log/kern.log (deleted)
in:imklog  1051  1812          syslog    9w      REG      254,0 44234481         22 /var/log/auth.log (deleted)
rs:main    1051  1813          syslog    7w      REG      254,0    18268         29 /var/log/syslog (deleted)
rs:main    1051  1813          syslog    8w      REG      254,0        0         26 /var/log/kern.log (deleted)
rs:main    1051  1813          syslog    9w      REG      254,0 44234481         22 /var/log/auth.log (deleted)
....

Perhaps, truncating the logs not syncronizeded properly with rsyslogd ...

File i removed not from this list.

restarting rsyslogd service solved the problem

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
 Share

2 2