Getting - /var/log is getting full (currently 100 % used) "Error"

[nik82]

Hi, I am getting /var/log is getting full (currently 100 % used) warning in fix common problems plugin. 

 

I have included the zip file generated for troubleshooting to this thread and was hoping someone could shine a light on what seems to be the issue. 

 

Thanks again. 

tower-diagnostics-20221025-1401.zip

[Squid]

@dlandon  What's up with 

Oct 25 12:12:00 Tower  smbd_audit[5748]: close fd 11 
Oct 25 12:12:00 Tower  smbd_audit[5748]: close fd 31 
Oct 25 12:12:00 Tower  smbd_audit[5748]: openat /A1. Media & Content/Shoots/Elf Bar/Cigalike/Output (fd 11) 
Oct 25 12:12:00 Tower  smbd_audit[5748]: openat A1. Media & Content/Shoots/Elf Bar/Cigalike/Output/Processed/Processed (fd 31) 

Continually going in there?

[nik82]

Hi, thanks for trying to help

 

edited: disabling the docker did not change anything.

 

Is it normal for Smbd_audit to scan every file and folder? 

 

added the latest syslog to show what i mean.

 

Edited October 26, 2022 by nik82

[B_Sinn3d]

I just noticed my log was 100% full as well with these errors.  I tracked it down to RecycleBin plugin which was just updated last night at 12am for me and started spamming the logs.  The version which it was updated to was recycle.bin-2022.10.21.tgz for reference.

 

I stopped the plugin and will follow up on that support post.

[dlandon]

Reinstall the recycle bin plugin and show the output of:

cat /etc/rsyslog.d/03-recycle-bin.conf 

 

Run this command to see if the log entries stop:

/etc/rc.d/rc.rsyslogd restart

 

[B_Sinn3d]

I reinstalled the plugin and ran the commands.

 

cat /etc/rsyslog.d/03-recycle-bin.conf

:msg,contains,"smbd_audit" stop

 

I am still seeing the smbd_audit spamming the logs.  stopped plugin again.

[dlandon]

Did you run this command?

/etc/rc.d/rc.rsyslogd restart

 

[B_Sinn3d]

17 minutes ago, dlandon said:

Did you run this command?

/etc/rc.d/rc.rsyslogd restart

 

I did.  I also just rebooted the server and when it came back up the smbd_audit was in the logs so I stopped it again.

[dlandon]

4 minutes ago, B_Sinn3d said:

I did.

and the messages stopped?

[B_Sinn3d]

No, only thing that stopped the messages was stopping the recycle.bin plugin.

[dlandon]

Post diagnostics file.

[B_Sinn3d]

I here is the original diagnostics that I also included in the plugin support forum.

 

if you need updated diags...let me know.

 

debo-server-diagnostics-20221025-1100.zip

[nik82]

I can confirm that my problem was also the recycle bin plugin. Once disabled the spamming stopped and log is no longer getting full. 

[dlandon]

Update to the latest version of the recycle bin.

[nik82]

@dlandon Thank you.

 

However I am sorry to say that it is still not working with version 2022.10.25a 

 

Actually it is worse now, server completely frozen this morning after updating last night and enabling the plugin again. Restarted the server and left it. 

 

This morning all shares unavailable and webui not reachable. 

 

After hard power reset the default port for Webui had for some reason changed back to port 80 which took ages to figure out. 

 

Was a bit of a nightmare, when I finally could login i checked syslog and it is again spammed with smbd_audit

 

 

tower-diagnostics-20221026-0948.zip

Edited October 26, 2022 by nik82

[dlandon]

That sounds like you had a flash drive problem.

 

Try this command and see if the logging stops:

/etc/rc.d/rc.rsyslogd restart

 

[Fromnack]

I am having the exact same issue, disabling Recycle Bin resolved the log spam for me. I was getting it on any sort of file/folder read/write activity. Recycle Bin is on version 2022.10.26a

 

Edit: Unraid version 6.11.1

Edited October 27, 2022 by Fromnack

[nik82]

Mine is working now after first uninstalling the plugin. Restarting, then updating to unraid 6.10.2. After update finished I installed the latest version of the plugin 2022.11.04a it now seems to be working as it should without spamming the log. 

 

Not sure which of my steps fixed the issue but it is working now. A big thank you to @dlandon for taking time to help and upgrading the plugin.