Bug 190498

Summary:	temp storage in /var/cache and disk space
Product:	[Fedora] Fedora	Reporter:	Curtis Doty <curtis>
Component:	logwatch	Assignee:	Ivana Varekova <varekova>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-05-05 09:47:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Curtis Doty 2006-05-02 22:11:25 UTC

Description of problem:

By default, it appears to extract gzipped archives into a working dir in
/var/cache/logwatch/. Which has a high potential to blow up the /var volume if,
for example, apache is a high-volume site and the logs are already rotated and
zipped in order to prevent just such a problem. :-/

Even worse, when logwatch blows up /var and dies, it leaves all the temp junk
behind so what would have been a brief blowup of space on /var instead is a
permanent disk full error requiring manual intervention.

Version-Release number of selected component (if applicable):
This was verified on v7.0, but a brief inspection of the v7.2 update does not
indicate that this issue was addressed.

How reproducible:

Roll out high-volume apache server with logwatch installed. Setup a logrotate
policy as needed for faster rotation and compression. Watch closely at 04:04
logwatch consume growingly huge amounts of space as it expands the compressed
logfiles. If it every fills up /var, BANG it will leave behind its mess and a
full volume.
  
Expected results:

#1 required: it should die gracefully and clean up its mess
#2 optional: some sort of sanity check before going to town on compressed huge
archive files

Comment 1 Ivana Varekova 2006-05-05 09:47:57 UTC

Thanks. I discuss this problem with upstream (thanks Bjorn) the upstream
solution is now built in the last version of logwatch - logwatch-7.3-2.
Could you test this version? If there is any problem, please add your comment here.