I recently installed Armbian Jammy on my Hardkernel Odroid-HC1. By monitoring the storage usage through SNMP, I quickly realised that something was filling up the /var/log mountpoint at an alarming rate (40 % usage after three weeks). At a closer inspection, it turned out to be the sysstat logs. Even though sysstat was set (out of the box) to only keep 7 days of history, I could see files that were several weeks old.

 

Having looked into the way that logs are synced to disc (or to the SD card rather), then rotated and synced back every night, it seems that the armbian-ramlog script is rather broken. It will move all of the sysstat logs, then expect the logrotation to rotate/compress/prune them (which it doesn't in the case of sysstat, since pruning is inherent in sysstat and logs aren't structured in the same way that others are). Finally, it will copy the files back (also old ones), thus effectively disabling the pruning mechanism of sysstat.

 

Am I missing something or is this a bug? Seems odd that this issue should have gone unnoticed until now...

 

Also, while looking into this issue, I noticed that the non-rsync armbian-ramlog does not respect sub-directories. For instance, /var/log.hdd/apt/* will get copied back to /var/log.

/usr/lib/armbian/armbian-ramlog

mod 150 line from

find . -type f -print | grep -E -v "(\.gz|\.xz|\.[0-9]|armbian-ramlog)|\.journal" | while IFS= read -r  file

to

find . -type f -print | grep -E -v "(\.gz|\.xz|\.[0-9]|armbian-ramlog)|\.journal|sar?[0-3][0-9]" | while IFS= read -r  file

can ignore sysstat files when doing postrotate.