/var/log on zram0

Recommended Posts

Hello, running  ARMBIAN 5.59 stable Debian GNU/Linux 9 (stretch) 4.14.65-sunxi on Banana Pi pro

/var/log is always full

df -h

/dev/zram0       49M   48M     0 100% /var/log


root@mail:/etc# zramctl
/dev/zram0 lz4            50M 47.5M  7.8M  8.4M       2 /var/log
/dev/zram1 lz4         249.7M    4K   63B    4K       2 [SWAP]
/dev/zram2 lz4         249.7M    4K   61B    4K       2 [SWAP]

Since i am running on sata (ssd of 128gig) i dont need that. Cannot find how to stop the mount of /var/log on /dev/zram0. Not in fstab. Want to use the real /var/log from / (root).



Link to post
Share on other sites
Armbian is a community driven open source project. Do you like to contribute your code?

I'm experimenting the same issue with a lot of devices, the 50Mo get filled up very quickly. Most of the time, nginx logs are responsible of that, but also hostapd in some case the wifi dongle is not present.


This is very very annoying as the server can not work properly after the log folder is full. The only way is to move/remove files.


I removed log2ram, but as I understand zram does the same !!



Link to post
Share on other sites

Hi martinayotte

On 11/20/2018 at 9:01 PM, martinayotte said:

Another possible workaround is to have a "crontab" job that delete or truncate files regularly ...


On var/log and var/log/.hdd : Done that, every hour, it works, obviously :-) .

also using sed to remove the "IR event FIFO is full" lines


But now, for a while or perhaps since then, my warning system, based on what df under /var/log reports gives false warnings : df misreports the real size


eg : in WinSCP, the calculate button says 2.2MB, where df says 75% of 50MB

Perhaps the varlog scripts are not happy with the delete/modify ?


Reboot repairs the mismatch


Edit :

Moved to using du iso df, du is reporting correctly.


so that is solved, but perhaps a point of attention for the developers ?




Link to post
Share on other sites


How could it be? zram is full, but /var/log is empty.

I think this happened when once the log was full and I deleted a large file.

How to fix it without rebooting?



root@hms:/var# uname -a
Linux hms 4.19.20-sunxi #5.75 SMP Sat Feb 9 19:02:47 CET 2019 armv7l armv7l armv7l GNU/Linux

root@hms:/var# zramctl
/dev/zram4 lzo         121,1M    4K   78B   12K       4 [SWAP]
/dev/zram3 lzo         121,1M    4K   78B   12K       4 [SWAP]
/dev/zram2 lzo         121,1M    4K   78B   12K       4 [SWAP]
/dev/zram1 lzo         121,1M    4K   78B   12K       4 [SWAP]
/dev/zram0                50M 43,8M  7,8M  8,7M       4 /var/log


root@hms:/var# df /var/log
Filesystem     1K-blocks  Used Available Use% Mounted on
/dev/zram0         49584 44780      1220  98% /var/log

root@hms:/var# du -k /var/log
12    /var/log/motion
4    /var/log/samba/cores/winbindd
4    /var/log/samba/cores/smbd
4    /var/log/samba/cores/nmbd
16    /var/log/samba/cores
28    /var/log/samba
4    /var/log/apache2
4    /var/log/apt
4    /var/log/unattended-upgrades
56    /var/log

Link to post
Share on other sites

Got it. Looks like a bug

lsof | grep /var/log


rsyslogd   1051                syslog    7w      REG      254,0    18268         29 /var/log/syslog (deleted)
rsyslogd   1051                syslog    8w      REG      254,0        0         26 /var/log/kern.log (deleted)
rsyslogd   1051                syslog    9w      REG      254,0 44234481         22 /var/log/auth.log (deleted)
in:imuxso  1051  1811          syslog    7w      REG      254,0    18268         29 /var/log/syslog (deleted)
in:imuxso  1051  1811          syslog    8w      REG      254,0        0         26 /var/log/kern.log (deleted)
in:imuxso  1051  1811          syslog    9w      REG      254,0 44234481         22 /var/log/auth.log (deleted)
in:imklog  1051  1812          syslog    7w      REG      254,0    18268         29 /var/log/syslog (deleted)
in:imklog  1051  1812          syslog    8w      REG      254,0        0         26 /var/log/kern.log (deleted)
in:imklog  1051  1812          syslog    9w      REG      254,0 44234481         22 /var/log/auth.log (deleted)
rs:main    1051  1813          syslog    7w      REG      254,0    18268         29 /var/log/syslog (deleted)
rs:main    1051  1813          syslog    8w      REG      254,0        0         26 /var/log/kern.log (deleted)
rs:main    1051  1813          syslog    9w      REG      254,0 44234481         22 /var/log/auth.log (deleted)

Perhaps, truncating the logs not syncronizeded properly with rsyslogd ...

File i removed not from this list.

restarting rsyslogd service solved the problem

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.