Hi,
I have contacted author of the program and send him ktrace and fstat
data, hoping he will find time to check where the problem might be.
arpalert is running from root partition and do not write any files to
this partition. Log is writen to /var partition and even if I disable
all writes to disk (lease file, log file) space on root partition is
still being consumed.
If I stop the program and wait exactly 60 seconds, the space will be freed.
fstat info:
router2# df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/sd0a 300M 96.8M 188M 34% /
/dev/sd0d 4.9G 176M 4.5G 4% /home
/dev/sd0e 4.9G 1.1G 3.6G 23% /usr
/dev/sd0f 4.9G 530M 4.1G 11% /var
mfs:29883 961M 22.0K 913M 0% /tmp
--------------------
router2# fstat -p 2250 -s
USER CMD PID FD MOUNT INUM MODE R/W
SZ|DV XFERS KBYTES
root arpalert 2250 text / 31197 -rwxr-xr-x r
154073 0 0
root arpalert 2250 wd / 29572 drwx------ r
512 0 0
root arpalert 2250 0 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 1 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 2 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 3 /var 311811 -rw-r--r-- w
10926 1 0
root arpalert 2250 4 clone 30396 crw------- rw
bpf0 180 42
root arpalert 2250 5 / 31206 -rw-r----- rw
6 1 0
router2# fstat -p 2250 -s
USER CMD PID FD MOUNT INUM MODE R/W
SZ|DV XFERS KBYTES
root arpalert 2250 text / 31197 -rwxr-xr-x r
154073 0 0
root arpalert 2250 wd / 29572 drwx------ r
512 0 0
root arpalert 2250 0 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 1 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 2 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 3 /var 311811 -rw-r--r-- w
10926 1 0
root arpalert 2250 4 clone 30396 crw------- rw
bpf0 232 49
root arpalert 2250 5 / 31206 -rw-r----- rw
6 1 0
router2# fstat -p 2250 -s
USER CMD PID FD MOUNT INUM MODE R/W
SZ|DV XFERS KBYTES
root arpalert 2250 text / 31197 -rwxr-xr-x r
154073 0 0
root arpalert 2250 wd / 29572 drwx------ r
512 0 0
root arpalert 2250 0 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 1 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 2 / 30780 crw-rw-rw- rw
null 0 0
root arpalert 2250 3 /var 311811 -rw-r--r-- w
10926 1 0
root arpalert 2250 4 clone 30396 crw------- rw
bpf0 237 50
root arpalert 2250 5 / 31206 -rw-r----- rw
6 1 0
--------------------
router2# find / -inum 31197
/root/opt_arpalert/sbin/arpalert
--
router2# find / -inum 29572
/root
--
router2# find / -inum 30780
/dev/null
--
router2# find /var -inum 311811
/var/log/arpalert.log
--
router2# find / -inum 31206
/root/opt_arpalert/var/run/arpalert.pid
--------------------
only thing that grows is:
root arpalert 2250 4 clone 30396 crw------- rw
bpf0 237 50
best regards,
RLW
W dniu 2018-06-27 o 18:59, Stuart Henderson pisze:
On 2018-06-26, RLW <seran...@o2.pl> wrote:
Hello,
info: OpenBSD 4.8 (em interface) and 6.3 (ix interface), arpalert-2.0.12
(downloaded and compiled).
Not related to this problem, but 4.8 is *really* old now, there have been
many security fixes since then.
problem: When arpalert is running disk space is being consumed, when
arpalert is stopped (after 20 minutes of being active) disk space is
freed (~3MB) (~10mb per hour).
Is there something wrong with this program or is it a normal behavior
when bpf is used? (some buffer grows??)
I don't know arpalert, but that's not normal for things using bpf.
What files does it have open? You can run fstat and get the filesystem
mountpoint and inode number of any open files, then use find to locate
them:
# find /mountpoint -inum 1234
That might give some clues as to what's happening.
