I'm running Debian 10 (Buster) on some embedded systems (Xilinx Zynq SoC
with SD card as filesystem).
My root filesystem is formatted to 1GB and normally is about 66% full.
Something is going wrong where syslog entries are being written to
`/var/log/syslog` and to a mystery file called `/cron`. logrotate will
rotate files in `/var/log` daily (via cron), but of course logrotate
knows nothing about the mystery `/cron` file and the rootfs ends being
full and the system breaks.
`lsof` shows that `rsyslogd` has the `/cron` file open. Removing the
`/cron` file sort of works, but the disk usage does not reduce. I have
to restart the `rsyslogd` service for Linux to release the disk space.
# lsof | grep ' /cron' ; ls -l /cron ; systemctl stop rsyslog ; rm
/cron ; ls -l /cron ; systemctl stop rsyslog.service ; lsof | grep '
/cron' ; ls -l /cron
rsyslogd 2256 root 7w REG 179,3
4068 1886 /cron
in:imuxso 2256 2258 root 7w REG 179,3
4068 1886 /cron
in:imklog 2256 2259 root 7w REG 179,3
4068 1886 /cron
rs:main 2256 2260 root 7w REG 179,3
4068 1886 /cron
-rw-r--r-- 1 root root 4068 Dec 5 23:57 /cron
Warning: Stopping rsyslog.service, but it can still be activated by:
syslog.socket
ls: cannot access '/cron': No such file or directory
Warning: Stopping rsyslog.service, but it can still be activated by:
syslog.socket
rsyslogd 2275 root 7w REG 179,3
1890 1886 /cron
in:imuxso 2275 2280 root 7w REG 179,3
1890 1886 /cron
in:imklog 2275 2281 root 7w REG 179,3
1890 1886 /cron
rs:main 2275 2282 root 7w REG 179,3
1890 1886 /cron
-rw-r--r-- 1 root root 1890 Dec 5 23:57 /cron
Is this a problem with `rsyslogd` ? Version 8.38.0 is installed.
Why is the mysterious file always called `/cron`? Is it related to
`logrotate` being called from `cron`?
The `/cron` file contains the same content as `/var/log/syslog`, except
that the timestamp is formatted differently.
# tail /cron ; tail /var/log/syslog
2018-12-06T00:01:26.259166+00:00 efd-0100 efd_app.py[1728]:
WARNING:root:cloud:Not enough data records to post (0).
2018-12-06T00:01:26.260017+00:00 efd-0100 efd_app.py[1728]: Empty()
2018-12-06T00:01:26.833718+00:00 efd-0100 efd_app.py[1728]: DEBUG:
TIMEOUT: adc_select_wait()
2018-12-06T00:01:26.834415+00:00 efd-0100 efd_app.py[1728]: DEBUG:
status = 0xFFF8F800
2018-12-06T00:01:26.834951+00:00 efd-0100 efd_app.py[1728]: DEBUG:
semaphore = 0x00000000
2018-12-06T00:01:28.140049+00:00 efd-0100 efd_app.py[1728]: DEBUG:
TIMEOUT: adc_select_wait()
2018-12-06T00:01:28.140532+00:00 efd-0100 efd_app.py[1728]: DEBUG:
status = 0xFFF8F800
2018-12-06T00:01:28.140987+00:00 efd-0100 efd_app.py[1728]: DEBUG:
semaphore = 0x00000000
2018-12-06T00:01:28.260158+00:00 efd-0100 efd_app.py[1728]:
WARNING:root:cloud:Not enough data records to post (0).
2018-12-06T00:01:28.260958+00:00 efd-0100 efd_app.py[1728]: Empty()
Dec 6 00:01:26 efd-0100 efd_app.py[1728]: WARNING:root:cloud:Not
enough data records to post (0).
Dec 6 00:01:26 efd-0100 efd_app.py[1728]: Empty()
Dec 6 00:01:26 efd-0100 efd_app.py[1728]: DEBUG: TIMEOUT:
adc_select_wait()
Dec 6 00:01:26 efd-0100 efd_app.py[1728]: DEBUG: status = 0xFFF8F800
Dec 6 00:01:26 efd-0100 efd_app.py[1728]: DEBUG: semaphore = 0x00000000
Dec 6 00:01:28 efd-0100 efd_app.py[1728]: DEBUG: TIMEOUT:
adc_select_wait()
Dec 6 00:01:28 efd-0100 efd_app.py[1728]: DEBUG: status = 0xFFF8F800
Dec 6 00:01:28 efd-0100 efd_app.py[1728]: DEBUG: semaphore = 0x00000000
Dec 6 00:01:28 efd-0100 efd_app.py[1728]: WARNING:root:cloud:Not
enough data records to post (0).
Dec 6 00:01:28 efd-0100 efd_app.py[1728]: Empty()
Thanks for any help,
Brendan.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
