Thank Rich, It seems to be tty12 (console logging) - I think disabling it in syslog-ng will be easiest but will do some testing first.
The recursive switch shows tty12 regularly ticking up. BillK On 17/2/20 10:13 am, Rich Freeman wrote: > On Sun, Feb 16, 2020 at 7:57 PM William Kenworthy <bi...@iinet.net.au> wrote: >> 2 ~ # lxc-attach -n mail -- bash -c "df -h" >> none 492K 320K 172K 66% /dev >> du and ls -al do not give any clues, the host /dev is normal and all >> running lxc instances do it, but at different rates > Are you running ls -al from INSIDE the container? If you're running > it on the host you won't see anything because it is almost certainly > in a separate mount namespace, and so it is invisible from the host. > In particular, any files you see in rootdir/dev from the host are NOT > visible in the container, and vice-versa. > > I don't use lxc, but if I had to take a wild guess your /dev isn't > being properly initialized inside, and some typical device node is > being created as a regular file and stuff like "echo foo > /dev/null" > is actually writing to a real file there, filling up the tmpfs. > > Try: > lxc-attach -n mail -- bash -c "ls -l --recursive /dev" > > Or launch an interactive shell inside the container and just poke > around in there. I have no idea what the "lxc way" to launch a shell > is, but you can always use: > nsenter --target <pid> --all /bin/bash > (where <pid> is the pid on the host of a process inside the container) > > nsenter is part of util-linux >
