File System on Logs Partition Full

[Jorge da Silva1709159479]

 I keep getting the message "File System on Logs Partition Full".

Can anyone tell me how I can completely stop or turn off the logs? has never been successful so far.

The XenServer version is 7.1 CU2 LTSR

 

[Tobias Kreidl]

Given you have the new partition layout (correct?) this should never happen unless there is a big issues, so I'd actually start by examining why you are getting so much logged. There is something wrong and the best course to take is to determine what the problem is and fix it, in which case the excessive logging will stop.  You'll have to look at different log files to see which is filling up (it may be more than one) but start by seeing which are the biggest.

 

-=Tobias

[Jorge da Silva1709159479]

It's all working, what am I looking for?
Enclosed is another PrintScreen. Maybe you can help me!

Greetings

 

 

[Alan Lantz]

Those don't look extremely bad, but if you are on the old partiton layout you may indeed be out of space.

what does df -h look like ?

 

--Alan--

 

[Jorge da Silva1709159479]

See picture

 

[Alan Lantz]

Okay, I missed something on that previous screen shot then because you definitely are using up that 4Gb of 

log space on /dev/sda5. Maybe there is something in one of those folders. But you should be able to safely

remove any large files in /var/log to free up some space. But yes, as Tobias mentions, you have some sort

of issue that likely needs to be resolved causing the excessive logging.

 

--Alan--

 

 

 

[Tobias Kreidl]

The audit logs look to be particularly large -- do you have a lot of rogue attempted connections?

[Jorge da Silva1709159479]

Yes, it runs XenDesktop with Windows Clients, about 600 VMs

[Jorge da Silva1709159479]

The problem is with the secure file. It gets too big because it logs the connection from our monitoring server.

But I would like to disable the logging for the file secure

[Jorge da Silva1709159479]

There is always a loop with this text.

 

Oct  2 00:40:01 g-bu-xen01 stunnel: LOG3[7131:139900895016704]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900895016704]: Connection closed: 1598 byte(s) sent to SSL, 451 byte(s) sent to socket
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900895016704]: Service [xapi] accepted connection from ::ffff:10.62.234.13:37686
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900892694272]: connect_blocking: connected 127.0.0.1:80
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900892694272]: Service [xapi] connected remote server from 127.0.0.1:53984
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900895016704]: connect_blocking: connected 127.0.0.1:80
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900895016704]: Service [xapi] connected remote server from 127.0.0.1:53986
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG3[7131:139900894242560]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900894242560]: Connection closed: 1597 byte(s) sent to SSL, 451 byte(s) sent to socket
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900894242560]: Service [xapi] accepted connection from ::ffff:10.62.234.13:37690
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG3[7131:139900895971072]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900895971072]: Connection closed: 1598 byte(s) sent to SSL, 451 byte(s) sent to socket
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900894242560]: connect_blocking: connected 127.0.0.1:80
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900894242560]: Service [xapi] connected remote server from 127.0.0.1:53988
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900895971072]: Service [xapi] accepted connection from ::ffff:10.62.234.13:37692
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG3[7131:139900922545920]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900922545920]: Connection closed: 1598 byte(s) sent to SSL, 451 byte(s) sent to socket
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900895971072]: connect_blocking: connected 127.0.0.1:80
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900895971072]: Service [xapi] connected remote server from 127.0.0.1:53990
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900922545920]: Service [xapi] accepted connection from ::ffff:10.62.234.13:37694
Oct  2 00:40:01 g-bu-xen01 stunnel: LOG5[7131:139900922545920]: connect_blocking: connected 127.0.0.1:80

 

 

[Jorge da Silva1709159479]

I have now disabled logging for the File secure.

Solution:
/etc/rsyslog.de/xenserver.conf file
disabled #authpriv.*

Restart service:
service rsyslog restart

The file is no longer generated.

[Alan Lantz]

Awesome. 

 

--Alan--

 

[Tobias Kreidl]

Glad you found the root cause and fixed it!

 

-=Tobias