RHEL 7.2 system, df and du /var/log inconsistent results. 84MB actual usage, df shows 80% full
I have a RHEL 7.2 system with a (miserably small) 4 GB /var/log xfs file system mounted (we're increasing it tomorrow). However, I'm noticing a very strange (to me) inconsistency between the results of
df -PhT /var/logdu -sk /var/log/*du -skh /var/logA
df -PhT /var/logdu -skh /var/logHere's some relevant info...
[root@rhel72server] # du -sk /var/log/* | sort -nr 21632 /var/log/messages 14920 /var/log/mesos 11004 /var/log/aide 2912 /var/log/httmpd 2648 /var/log/exhibitor.log *truncated* [root@rhel72server] # du -skh /var/log 84M /var/log [root@rhel72server] # df -PhT /var/log /dev/mapper/disk0-varlog xfs 4G 4.2G 825M 80% /var/log
I've zeroed out the lastlog sparse fiile by redirecting /dev/null to it and that makes no difference to the above.
My initial search led me to do an
lsof | grep deleteddf -PhT /var/log[root@rhel72server] # cd /var/log [root@rhel72server] # lsof | grep deleted sssd_be 1828 root 10w REG 253,7 3258809724 4194460 /var/log/sssd/sssd_redacted_fqdn.log-20160501 (deleted) sssd 1823 root 3w REG 253,7 62771719 4194459 /var/log/sssd/sssd.log-20160501 (deleted) sssd_be 1828 root 17w REG 253,7 1482662 4194453 /var/log/sssd/ldap_child.log-20160502 (deleted) wpa_suppl 1837 root 3w REG 253,7 120 145 /var/log/wpa_supplicant.log-20160504 (deleted) *truncated for only /var/log*
So seeing that "sssd" is the
life of the party[root@rhel72server] # systemctl restart sssd [root@rhel72server] # df -PhT /var/log /dev/mapper/disk0-varlog xfs 4G 4.2G 4.0G 3% /var/log
And this released the files in question so
dfduDoes anyone have any ideas on how to deal with sssd logs that are rotated off ? (I have already added "compress" to the logrotate directives, and I plan on examining sssd logs for errant issues)
I turned
debug_level = 5debug_level = 1[sssd][domain/redacted.fqdn.something]I'd appreciate any assistance/recommendations.
Thanks
RJ
Responses