Demande #5940: Gestion de l'espace disque des logs systemd - Admins - Gestionnaire de projets de l'April

Actions

Copy link

Demande #5940

open

Gestion de l'espace disque des logs systemd

Added by François Poulain over 2 years ago. Updated 5 days ago.

Status:

En cours de traitement

Priority:

Normale

Assignee:

François Poulain

Category:

Target version:

Décembre 2024

Start date:

07/24/2022

Due date:

% Done:

Estimated time:

Difficulté:

2 Facile

Description

A l'occasion d'un reboot, vu sur mail :

░░ Subject: Espace disque utilisé par le journal
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ Documentation: man:journald.conf(5)
░░ 
░░ System Journal (/var/log/journal/3e08aff87de2df4b85ab7dff31b48af5) utilise actuellement 912.0M.
░░ Le maximum autorisé est défini à 871.9M.
░░ Au moins 435.9M doivent être laissés libres
░░ (sur 3.8G d'espace disque actuellement libre).
░░ La limite appliquée est donc 871.9M, dont 0B
░░ sont toujours disponibles.
░░ 
░░ Les limites définissant la quantité d'espace disque que peut utiliser le
░░ journal peuvent être configurées avec les paramètres SystemMaxUse=,
░░ SystemKeepFree=, SystemMaxFileSize=, RuntimeMaxUse=, RuntimeKeepFree=,
░░ RuntimeMaxFileSize= dans le fichier /etc/systemd/journald.conf.
░░ Voir journald.conf(5) pour plus de détails.

Actions

Copy link

Updated by François Poulain over 2 years ago

Je cherche donc qui crache du log. Je trouve un dovecot en mode debug.

Actions

Copy link

Updated by François Poulain over 2 years ago

On voit aussi beaucoup de connexion failed après auth dans les logs postfix. Un fail2ban (ou un réglage de fail2ban) serait utile.

Actions

Copy link

Updated by François Poulain over 2 years ago

Status changed from Nouveau to En cours de traitement
Assignee set to François Poulain
Target version changed from Backlog to Été 2022

Actions

Copy link

Updated by François Poulain over 2 years ago

Pour le soucis initial, j'ai demandé à journalctl de réduire la voilure :

(April) root@mail:/var/log# journalctl --disk-usage
Archived and active journals take up 912.0M in the file system.

(April) root@mail:/var/log# systemctl start systemd-journal-flush.service

-> Ok.

Actions

Copy link

Updated by Quentin Gibeaux over 2 years ago

Target version changed from Été 2022 to Septembre 2022

Actions

Copy link

Updated by Quentin Gibeaux about 2 years ago

Target version changed from Septembre 2022 to Octobre 2022

Actions

Copy link

Updated by Quentin Gibeaux about 2 years ago

Target version changed from Octobre 2022 to Novembre 2022

Actions

Copy link

Updated by Quentin Gibeaux about 2 years ago

Target version changed from Novembre 2022 to Décembre 2022

Actions

Copy link

Updated by Quentin Gibeaux almost 2 years ago

Target version changed from Décembre 2022 to Janvier 2023

Actions

Copy link

#10

Updated by Quentin Gibeaux almost 2 years ago

Target version changed from Janvier 2023 to Février 2023

Actions

Copy link

#11

Updated by Frédéric Couchet almost 2 years ago

Target version changed from Février 2023 to Mars 2023

Actions

Copy link

#12

Updated by Quentin Gibeaux over 1 year ago

Target version changed from Mars 2023 to Avril 2023

Actions

Copy link

#13

Updated by Quentin Gibeaux over 1 year ago

Target version changed from Avril 2023 to Mai 2023

Actions

Copy link

#14

Updated by Quentin Gibeaux over 1 year ago

Target version changed from Mai 2023 to Juin 2023

Actions

Copy link

#15

Updated by Quentin Gibeaux over 1 year ago

Target version changed from Juin 2023 to Été 2023

Actions

Copy link

#16

Updated by Quentin Gibeaux over 1 year ago

Target version changed from Été 2023 to Septembre 2023

Actions

Copy link

#17

Updated by Quentin Gibeaux about 1 year ago

Target version changed from Septembre 2023 to Octobre 2023

Actions

Copy link

#18

Updated by Quentin Gibeaux about 1 year ago

Target version changed from Octobre 2023 to Novembre 2023

Actions

Copy link

#19

Updated by Quentin Gibeaux about 1 year ago

Target version changed from Novembre 2023 to Décembre 2023

Actions

Copy link

#20

Updated by Quentin Gibeaux 11 months ago

Target version changed from Décembre 2023 to Janvier 2024

Actions

Copy link

#21

Updated by Quentin Gibeaux 10 months ago

Target version changed from Janvier 2024 to Février 2024

Actions

Copy link

#22

Updated by Quentin Gibeaux 9 months ago

Target version changed from Février 2024 to Mars 2024

Actions

Copy link

#23

Updated by François Poulain 9 months ago

J'avais ouvert ce ticket dans un but d'information mais je ne sais pas si c'est utile d'agir plus en avant. On peut éventuellement ajuster le SystemMaxFileSize dans journald.conf.d/ sur les différents serveurs.

Globalement on en est ici :

$ ./admin/scripts/do.sh ===== bastion =====
1,4G ===== admin =====
3,3G ===== dns =====
363M ===== mail =====
921M ===== sympa =====
817M ===== adl =====
362M ===== lamp =====
609M ===== agir =====
897M ===== bots =====
393M ===== dtc =====
1,4G ===== republique-numerique ===== mumble =====
349M ===== candidatsfr =====
457M ===== pad =====
377M ===== scm =====
457M ===== pouet =====
429M ===== webchat =====
785M ===== spip =====
368M ===== pad-test =====
585M ===== calamus.april.org =====
417M ===== galanga.april.org =====
385M du -sh /var/log/journal/ /var/log/journal/
Shared connection to vip.april.org closed. /var/log/journal/
Shared connection to admin.cluster.april.org closed. /var/log/journal/
Shared connection to dns.cluster.april.org closed. /var/log/journal/
Shared connection to mail.cluster.april.org closed. /var/log/journal/
Shared connection to sympa.cluster.april.org closed. /var/log/journal/
Shared connection to adl.cluster.april.org closed. /var/log/journal/
Shared connection to lamp.cluster.april.org closed. /var/log/journal/
Shared connection to agir.cluster.april.org closed. /var/log/journal/
Shared connection to bots.cluster.april.org closed. />du: cannot access '/var/log/journal/': No such file or directory
Shared connection to dtc.cluster.april.org closed. />du: cannot access ‘/var/log/journal/’: No such file or directory
Shared connection to drupal6.cluster.april.org closed. /var/log/journal/
Shared connection to drupal-test.cluster.april.org closed. =====
401M /var/log/journal/
Shared connection to republique-numerique.cluster.april.org closed. /var/log/journal/
Shared connection to mumble.cluster.april.org closed. /var/log/journal/
Shared connection to candidatsfr.cluster.april.org closed. /var/log/journal/
Shared connection to pad.cluster.april.org closed. /var/log/journal/
Shared connection to scm.cluster.april.org closed. /var/log/journal/
Shared connection to pouet.cluster.april.org closed. /var/log/journal/
Shared connection to webchat.cluster.april.org closed. /var/log/journal/
Shared connection to spip.cluster.april.org closed. />kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535 /var/log/journal/
Shared connection to virola.april.org closed. /var/log/journal/
Shared connection to calamus.april.org closed. /var/log/journal/
Shared connection to galanga.april.org closed.