Re: ksymoops filling up; find not rm'ing

[Joey Hess <joey@kitenet.net>]

Steve Taylor wrote:
> What causes /var/log/ksymoops to filling this partition with close to
> 100Meg of data daily? Anacron cleans it out daily with /etc/cron.daily/modutils calling
> /sbin/insmod_ksymoops_clean but '..clean' uses a find syntax that
> doesn't work -- or I misunderstand:
> 		"find /var/log/ksymoops -type f -atime +2 -exec rm {} \;"
> Run on June 13, this line did not remove June 11's ksymoops.

The -atime +2 indicates removal of files that are more than 24 hours old. 
So not necessarily all files from 2 days ago.. Also, note it's an atime test,
so if you even read the file, it won't be removed until 24 hours later.

The logs are generated when modules are loaded into the kernel. This is
explained in modprobe(8):

LOGGING COMMANDS
       If directory /var/log/ksymoops exists and modprobe is  run
       with  an  option that could load or a delete a module then
       modprobe  will  log  its  command  and  return  status  in
       /var/log/ksymoops/`date +%Y%m%d.log`.   There is no switch
       to disable this automatic logging, if you do not  want  it
       to  occur,  do  not  create  /var/log/ksymoops.   If  that
       directory exists, it should be owned by root and  be  mode
       644 or 600 and you should run script insmod_ksymoops_clean
       every day or so.

It also creates the other files in there, although this may not be
documented.

I believe the main purpose of the log files is to give ksymoops a snapshot
of the state your system was in when an oops occurred -- if the oops was
in module code, it needs a way to know what modules were loaded and what
symbols came from the modules.

The .log files are also useful if you have excessive module loading going on,
and want to try to debug it.

Anyway, removing the directory does turn it off nicely. But it will be
re-enabled with the next upgrade of modutils. I'm filing a bug to get that
fixed.

-- 
see shy jo