0

I am using a Linux-based switch and it has created many logs due to some known bugs. The problem is that the log files even exceed the physical flash size. I would like to ask what happened to the flash in this state? I tried to download the log file to the windows platform and read it. The actual size and content are normal. The typical content is as follows：

Jan  3 00:00:02 SWITCH : mac-address 000e.c6c1.3a03 vid 1 move from interface eth0/7 to interface eth0/5
Jan  3 00:00:02 SWITCH : mac-address 000e.c6c1.3a03 vid 1 move from interface eth0/5 to interface eth0/7
Jan  3 00:00:02 SWITCH : mac-address 000e.c6c1.3a03 vid 1 move from interface eth0/7 to interface eth0/5
Jan  3 00:00:03 SWITCH : mac-address 000e.c6c1.3a03 vid 1 move from interface eth0/5 to interface eth0/7
Jan  3 00:00:03 SWITCH : mac-address 000e.c6c1.3a03 vid 1 move from interface eth0/7 to interface eth0/5

more ops below:

root@SWITCH:/var/log# pwd
/var/log
root@SWITCH:/var/log# ls -lh
total 1.3G
-rw-r----- 1 root adm  265M Jan  1 03:17 all
-rw-r----- 1 root adm  367M Jan  3  1970 all.1
-rw-r--r-- 1 root root    0 Mar 27  2019 btmp
-rw-r--r-- 1 root root  292 Jan  1 00:15 lastlog
-rw-r----- 1 root adm  263M Jan  1 03:13 syslog
-rw-r----- 1 root adm  364M Jan  3  1970 syslog.1
-rw-r--r-- 1 root root  19K Jan  1 00:15 wtmp
...
root@SWITCH:/var/log# du -h *
265M    all
367M    all.1
0       btmp
4.0K    lastlog
263M    syslog
364M    syslog.1
20K     wtmp
...
root@SWITCH:/var/log# df -h
Filesystem      Size  Used Avail Use% Mounted on
rootfs          215M  214M   28K 100% /
ubi0:rootfs     215M  214M   28K 100% /
devtmpfs        124M     0  124M   0% /dev
tmpfs            25M   96K   25M   1% /run
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs            50M  4.0K   50M   1% /run/shm
tmpfs           124M     0  124M   0% /tmp
ubi2:data        12M   44K   12M   1% /data
root@SWITCH:/var/log# mount
ubi0:rootfs on / type ubifs (rw,relatime)
devtmpfs on /dev type devtmpfs (rw,relatime,size=126736k,nr_inodes=31684,mode=755)
tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=25368k,mode=755)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=50720k)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620)
tmpfs on /tmp type tmpfs (rw,nosuid,noexec,relatime)
ubi2:data on /data type ubifs (rw,relatime)

Linux SWITCH 3.10.70 #1 SMP Fri Jul 10 03:00:57 UTC 2020 armv7l GNU/Linux
rroot@SWITCH:/var/log# ls -lshiA
total 1.3G
9504  29M -rw-r----- 1 root root  29M Jan  1 00:39 .all.swp
9438 265M -rw-r----- 1 root adm  265M Jan  1 08:17 all
9406 367M -rw-r----- 1 root adm  367M Jan  3  1970 all.1
 902    0 -rw-r--r-- 1 root root    0 Mar 27  2019 btmp
9422 4.0K -rw-r--r-- 1 root root  292 Jan  1 00:15 lastlog
9439 263M -rw-r----- 1 root adm  263M Jan  1 03:13 syslog
9407 364M -rw-r----- 1 root adm  364M Jan  3  1970 syslog.1
 901  20K -rw-r--r-- 1 root root  19K Jan  1 00:15 wtmp

I am very confused, hope to find some help here, thanks!

Cloud Blue
  • 1

1 Answers1

1

Ubifs does on-the-fly compression, and log files compressed very well (and from your sample, they would compress very,very well due to the repetition, possibly around 20x or better, from personal experience). So having files much larger than the hardware capacity would be normal.

xenoid
  • 8,888