I have a Zentyal 6.2 server that 2 days ago start going crazy logging on syslog.
I only uses it for the Samba services:
ii language-pack-zentyal-es 6.2 all Zentyal translations for language Spanish
ii zentyal-core 6.2.3 all Zentyal - Core
ii zentyal-dns 6.2.0 all Zentyal - DNS Server
ii zentyal-firewall 6.2.0 all Zentyal - Firewall
ii zentyal-network 6.2.0 all Zentyal - Network Configuration
ii zentyal-ntp 6.2.0 all Zentyal - NTP Service
ii zentyal-samba 6.2.0 all Zentyal - Domain Controller and File Sharing
ii zentyal-software 6.2.0 all Zentyal - Software Management
Here is an example of the last half a second of syslog:
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|connectpath|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|open|ok|r|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|chdir|ok|chdir|/home/samba/shares/auditoria
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:580012:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|/home/samba/shares/auditoria
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|fstat|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|create_file|ok|0x100081|file|open|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|get_alloc_size|ok|0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|close|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|get_alloc_size|ok|0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|realpath|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|connectpath|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:6e06fa:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:6e06fa:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|connectpath|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:580012:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|/home/samba/shares/auditoria
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|chdir|ok|chdir|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:6e06f9:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|/home/samba/shares/auditoria/Sigma10/Formularios/F2149v05m2/Formularios/F2149v05
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|realpath|ok|OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|connectpath|ok|OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|open|ok|r|OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|chdir|ok|chdir|/home/samba/shares/auditoria
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:580012:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|/home/samba/shares/auditoria
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|fstat|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|close|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:6e06fa:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|connectpath|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:580012:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|/home/samba/shares/auditoria
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|chdir|ok|chdir|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:6e06fa:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|/home/samba/shares/auditoria/Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|realpath|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|connectpath|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|open|ok|r|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|chdir|ok|chdir|/home/samba/shares/auditoria
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|.
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|file_id_create|ok|fd00:580012:0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|/home/samba/shares/auditoria
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|fstat|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|create_file|ok|0x100081|file|open|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|get_alloc_size|ok|0
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|close|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|stat|ok|Sigma10/Formularios/F2149v05m2/Formularios/F2149v05/OTROS
Aug 4 11:13:39 zentyal smbd_audit: OFICINA\funcionario|192.168.1.19|get_alloc_size|ok|0
File is getting 5.9GB each day when logrotate works:
-rw-r----- 1 syslog adm 2,5G ago 4 11:07 /var/log/syslog
-rw-r----- 1 syslog adm 5,9G ago 4 00:07 /var/log/syslog.1
-rw-r----- 1 syslog adm 105K ago 3 07:35 /var/log/syslog.2.gz
CPU usage is going around 25-50% only for that
top - 11:25:58 up 21:32, 2 users, load average: 0,37, 0,33, 0,37
Tasks: 131 total, 1 running, 90 sleeping, 0 stopped, 1 zombie
%Cpu(s): 12,1 us, 14,6 sy, 0,0 ni, 73,0 id, 0,2 wa, 0,0 hi, 0,2 si, 0,0 st
KiB Mem : 4039124 total, 169220 free, 2091464 used, 1778440 buff/cache
KiB Swap: 999420 total, 971596 free, 27824 used. 1688296 avail Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
257 root 19 -1 409668 253676 241640 S 20,3 6,3 32:06.75 systemd-journal
26383 syslog 20 0 269076 4832 3152 S 17,9 0,1 20:20.22 rsyslogd
22529 root 20 0 585824 64308 34696 S 14,6 1,6 8:37.68 smbd
I have disabled logs from webmin and modified /etc/zentyal/samba.conf disable_fullaudit = yes
My partitions are getting full quickly:
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/zentyal5--vg-root 196G 128G 59G 69% /
Someone has a clue? Thanks in advance
Have a nice day!