0

Here is a munin screenshot about it: SSD raid filled and emptied

It filled at around: 07/Nov/2017:19:41:03 and emptied at: 08/Nov/2017:04:05:05.

The closest cronjob was at 04:05:50, a postfix & dovecot restart.

I know these from other services logs, the root drives were so full even logging stopped at that point.

I'm using debian 9, with the following services running:

[ + ] acpid [ + ] ajenti [ + ] apache-htcacheclean [ + ] apache2 [ + ] atd [ + ] avahi-daemon [ + ] cron [ + ] dbus [ + ] dovecot [ + ] fail2ban [ + ] irqbalance [ + ] kmod [ + ] memcached [ + ] minissdpd [ + ] munin-node [ + ] mysql [ + ] networking [ + ] ntp [ + ] postfix [ + ] procps [ + ] rc.local [ + ] rpcbind [ + ] rsyslog [ + ] smartmontools [ + ] ssh [ + ] stunnel4 [ + ] udev [ + ] unattended-upgrades [ + ] urandom

My question is, how could I track down what caused this strange disk fillup ( & emptying ) ? And if not, can i prevent it somehow?

Viktor Koncsek
  • 101
  • Look in `/var/log/` and which program generates that lots of output. – Ipor Sircer Nov 08 '17 at 15:21
  • Szia Ipor! **Well, it was auth.log and:** `Nov 7 19:54:01 wwNov 8 04:06:01 www CRON[12546]: pam_unix(cron:session): session opened for user root by (uid=0)` **but this was the first from postfix:** `[Tue Nov 07 19:41:03.716505 2017] [log_config:warn] [pid 30788] (28)No space left on device: [...]` – Viktor Koncsek Nov 08 '17 at 15:26
  • Look at the biggest logfile and search for a tons on duplicated lines in it. – Ipor Sircer Nov 08 '17 at 15:45

0 Answers0