Dear Maintainer,
My Debian box's hard disk filled up due to a single buggy user
application spewing messages at syslog. While I blame the application,
Debian's rsyslog should be more robust by default.
This is something I've seen happening more and more frequently.
A typical response people get when googling the problem is
"sudo rm /var/log/* and then set that up to run daily as a cronjob."
That's terrible advice and makes Debian seem shoddy.
Ideally, I'd like to see some sort of rate-limiter added to rsyslog.
In the meantime, here is a simple three step fix which would improve
stability for many people using Debian.
1. /etc/rsyslog.conf: add user.none to /var/log/syslog, debug, and messages.
That way, the spewage is limited to a single file, user.log.
2. /etc/logrotate.d/rsyslog: add "maxsize" so that log files that are
greater than a certain size are rotated even if their time
criteria are not due. I suggest "maxsize 1G" is reasonable for
most people and can be adjusted for those who want more.
3a. Move /etc/cron.daily/logrotate to /etc/cron.hourly/ so that file
sizes are checked more often. (This also fixes the "bug" where an
hourly entry in logrotate.conf only gets rotated daily.)
3b. /usr/lib/systemd/system/logrotate.timer: Likewise for systemd.
[Timer] [Timer]
OnCalendar=daily --> OnCalendar=hourly
AccuracySec=1h AccuracySec=1m
Persistent=true Persistent=true
Steps 1 and 2 ensure that the disk will not fill up and that important
system messages won't be rotated away too quickly based on file size.
Step 3 is necessary because the time in which a log file can fill up
/var is no longer measured in days. Currently, I have a single
chromium process sending over thirty thousand messages per second and
I doubt that's even close to the maximum possible.
Thank you.
*** Reporter, please consider answering these questions, where appropriate ***
* What led up to the situation?
* What exactly did you do (or not do) that was effective (or
ineffective)?
* What was the outcome of this action?
* What outcome did you expect instead?
*** End of the template - remove these template lines ***