Resolution

There are a number of possible resolutions:

• Determine if a process is creating unexpected or unwanted files or directories.
• Remove unnecessary or unwanted files or directories.
• Reorganize files and directories within the filesystem to reduce the number of entries in each individual directory.
• Use shorter filenames.
• Change the block size of the filesystem. This option requires a re-format of the filesystem, since the block size cannot be changed once it is set.
  CAUTION: Before re-formatting the filesystem backup any important files to another device as reformatting will recreate the filesystem metadata and not retain information about existing files. By default the ext3 block size for small volumes is 1024. If possible format the disk with 4096 bytes (4k) block size as follows:

# mkfs -t ext3 -b 4096 /dev/device

• Disable dir_index option of the filesystem.
  Note: There is no need to unmount the file system.
  CAUTION: Disabling this option may impact performance on lookups in large directories.

# tune2fs -O ^dir_index /dev/device

• To recreate the dir_index:

# umount /dev/device
# tune2fs -O dir_index /dev/device
# e2fsck -D /dev/device

• Optimize directories in filesystem.

# man e2fsck
...
       -D     Optimize  directories  in filesystem.  This option causes e2fsck to try to optimize all directories, either by reindexing them if the
              filesystem supports directory indexing,  or by sorting and compressing directories for smaller directories, or for filesystems  using
              traditional linear directories.

              Even  without  the -D option, e2fsck may sometimes optimize a few directories --- for example, if directory indexing is enabled and a
              directory is not indexed and would benefit from being indexed, or if the index structures are corrupted and need to be rebuilt.   The
              -D  option  forces  all  directories  in  the filesystem to be optimized.  This can sometimes make them a little smaller and slightly
              faster to search, but in practice, you should rarely need to use this option.

              The -D option will detect directory entries with duplicate names in a single directory, which e2fsck normally does  not  enforce  for
              performance reasons.

• To identify the directory, use the following auditd rule. You can get the audit log of the rule with ausearch -m syscall -k for_ext3_dx_add_entry_warning.

-a exit,always -F arch=b64 -S open -S openat -S creat -S link -S symlink -S mkdir -F exit=-ENOSPC -k for_ext3_dx_add_entry_warning