Samba is configured to log stuff for each host in a uniquely named
file. Many months ago I decided that logrotate should rotate those
logs as well as the default log.[sn]mbd files. Seems simple, right?
I configured basically logrotate like this :
/var/log/samba/samba-log.*
{
weekly
rotate 7
delaycompress
}
This morning I noticed the CPU load was quite high. top showed that
logrotate was using most of that CPU time, and had already used around
5 hours of CPU time. Wondering why it was behaving so oddly, I put an
strace in the cron.daily script and saw a lot of lstat64() calls on
somewhat odd looking file names.
Well, the problem lies in the glob pattern above. It turns out I had
on the order of 98000 files in /var/log/samba! Running 'ls' or
anything dealing with more than one file was quite slow. (ext3, by
the way) There were around 4000 logfiles for each host that had
created a log file.
Initially a log file would be created, such as
samba-log.dman
On the next logrotate run, the directory would contain
samba-log.dman
samba-log.dman.1
On the next run, both of those are seen as log files. They get
rotated, leaving
samba-log.dman
samba-log.dman.1
samba-log.dman.2
samba-log.dman.1.1
in the directory. Next rotation :
samba-log.dman
samba-log.dman.1
samba-log.dman.2
samba-log.dman.3
samba-log.dman.1.1
samba-log.dman.1.2
samba-log.dman.1.1.1
samba-log.dman.2.1
and so on.
Each rotated copy of the log was seen as a logfile in its own right!
Oops!
The solution is to reformat the filenames sambe uses to create the
logs and use a glob like /var/log/samba/host.*.log in logrotate's
configuration. Then it won't see the .1, etc., files as log files.
I hope you found this story amusing, and maybe posting this will
prevent someone else from making the same oversight.
-D
--
"...the word HACK is used as a verb to indicate a massive amount
of nerd-like effort." -Harley Hahn, A Student's Guide to Unix
http://dman.ddts.net/~dman/
Attachment:
pgpJe4lS_UK2g.pgp
Description: PGP signature