0

Here is a munin screenshot about it: SSD raid filled and emptied

It filled at around: 07/Nov/2017:19:41:03 and emptied at: 08/Nov/2017:04:05:05.

The closest cronjob was at 04:05:50, a postfix & dovecot restart.

I know these from other services logs, the root drives were so full even logging stopped at that point.

I'm using debian 9, with the following services running:

[ + ] acpid [ + ] ajenti [ + ] apache-htcacheclean [ + ] apache2 [ + ] atd [ + ] avahi-daemon [ + ] cron [ + ] dbus [ + ] dovecot [ + ] fail2ban [ + ] irqbalance [ + ] kmod [ + ] memcached [ + ] minissdpd [ + ] munin-node [ + ] mysql [ + ] networking [ + ] ntp [ + ] postfix [ + ] procps [ + ] rc.local [ + ] rpcbind [ + ] rsyslog [ + ] smartmontools [ + ] ssh [ + ] stunnel4 [ + ] udev [ + ] unattended-upgrades [ + ] urandom

My question is, how could I track down what caused this strange disk fillup ( & emptying ) ? And if not, can i prevent it somehow?

  • Look in /var/log/ and which program generates that lots of output. – Ipor Sircer Nov 8 '17 at 15:21
  • Szia Ipor! Well, it was auth.log and: Nov 7 19:54:01 wwNov 8 04:06:01 www CRON[12546]: pam_unix(cron:session): session opened for user root by (uid=0) but this was the first from postfix: [Tue Nov 07 19:41:03.716505 2017] [log_config:warn] [pid 30788] (28)No space left on device: [...] – Viktor Koncsek Nov 8 '17 at 15:26
  • Look at the biggest logfile and search for a tons on duplicated lines in it. – Ipor Sircer Nov 8 '17 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.