Date: Wed, 13 Aug 2008 11:46:03 -0700 From: Christopher Cowart <ccowart@rescomp.berkeley.edu> To: freebsd-questions@freebsd.org Subject: Lots of accounting data Message-ID: <20080813184603.GA25990@hal.rescomp.berkeley.edu>
next in thread | raw e-mail | index | archive | help
--9jxsPFA5p3P2qPhR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hello,
I'm playing a game of cat and mouse with process accounting and disk
space. I built some boxes with 9GB /var partitions, rolled them into
production, and after about 4 days of full load, /var filled up.
Looking at the size of /var/account/acct{,.0}, and figuring I'd be
seeing a 200% load increase in about a month, I created a new label from
the large chunk of free space I saved for situations like this. 40GB
mounted to /var/account: usage was down to 20%, and I thought the crisis
was averted.
About a week and a half later, I get a disk full e-mail from nagios and
> +pid 94696 (gzip), uid 0 inumber 6 on /var/account: filesystem full
in my dailies again. My /var/account/acct file was 17GB in size. Add one
rotation before compression and I completely lose that feeling of
cleverness I had when I gave accounting a dedicated 40GB partition.
If you're wondering how I can possibly have this much accounting data,
two `vmstat -f' invocations 100 seconds apart show 32282 forks (an
average of 323 per second). These boxes are running squid with a
redirect script to implement a captive portal. There are generally
several hundred unauthenticated users; all of their http traffic, from
firefox to the little weather widgets and spyware phoning home, gets
proxied through squid and subsquently a redirect script that, among
other things, does some text munging on the URL, and queries various
ipfw tables to determine what "context" the user is in. Some of this
could be optimized to launch fewer processes, but the code would be less
maintainable.
I only really see two options, neither of which I particularly like:
* Throw more disk at the problem (but given what I've seen, I don't
like the odds that within a month or two, I'll realize I didn't give
it enough).
* Turn off accounting on these boxes.
Are these really my only options? Is there any kind of tuning I can be
doing?
--=20
Chris Cowart
Network Technical Lead
Network & Infrastructure Services, RSSP-IT
UC Berkeley
--9jxsPFA5p3P2qPhR
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (FreeBSD)
iQIcBAEBAwAGBQJIoyvrAAoJEIGh6j3cHUNPiJoP/1ryvQqJ9Sg1AK4DTe9LOTlA
TtsqCHBiPSMbQl6M5Z7cVF8HE1LLMdQu+HeKospcct5sc1kcsYu5xNVoKtd8itWF
T9ke5OH3zD1Ox+GH1otvbrBhBD8WNKO1FJ5htaIWZqT4Z7emXmbXVlBhZ68GpjBi
5jINk38Ok2j3hdVzbFXe/9eOP3O8VZy/WJsrTNQt8vWmxuhzWNLHOE4PxE/BG6bb
tT9SmGwc6yiQukKH6iGESzP+XpeKlhNSRJhjsPyx8cpnTuoFgKde5JU70YYA3hWh
5TQCChBdvRyYZxgTESyNTpSv22rR4Sr3TdYkc6S5zV0gWBr5WG4WQ7jzDV+qsR4b
ntSbpmJltx8C25t+P2uAuU/b0Al00zwZMfNdh2LhFfvcKeE9EVWT4xxKV2HzwxXh
AWfJmZnl7qpupC4n8FwwH3UxFzZMsF6YAesff8dzWPNFHzIVIvXvjiX+qV1oaUP9
KEi2VsVlRNC+9NbL5dnfFzAT00RXuWCWFvyy42vEr6/verAnvRUggwAfpX/AMIAl
3dObJeLLcVIBz02ZQHv/MgWhmm4SvY7S3tRm+aJ0zdpv+0uVVicTH7jumY+hnwM6
+0KgjeAssmX3wqwUgwBaz39BPlK9ZCmfag8ei4OrOsOQIyhny47ZIK0oX2+oS31c
mEed1WLeZqXF+GGlg+Vp
=rjV/
-----END PGP SIGNATURE-----
--9jxsPFA5p3P2qPhR--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080813184603.GA25990>