On 10/30/18 16:28, Bob Friesenhahn wrote:
On Tue, 30 Oct 2018, Udo Grabowski (IMK) wrote:

P.S: During this e-mail writing, number of file grew further:
$ find /var/cache/fontconfig/ -type f | wc -l
526905

man fam:
...
DESCRIPTION
      FAM, the File Alteration Monitor, is a subsystem that applications can       use to be notified when specific files or directories are changed.  It       is intended as a replacement for mechanisms such as poll and select.
....

So indeed that potentially can have something to do with your
problem if the process polluting your cache wants the FAM service
and doesn't get it and then falls back to something insane.

Recent illumos has added Linux compatibility functions to support LX Zone functionality and these compatibility functions might be picked up and used by accident by software which targets Linux.  I don't know if there is an emulation of inotify(7) but it seems like something important to emulate for LX Zones.

Regardless, the Dtrace Toolkit provides scripts (opensnoop and iosnoop) which allows observing all I/O activity on the system and so it should quickly reveal the offender.

Bob
Hi,

no idea how I have missed opensnoop (probably because iosnoop I have tried was useless):
$ /opt/DTT/Bin/iosnoop
  UID   PID D    BLOCK   SIZE       COMM PATHNAME
...
    0   381 W 275526024  32768 zpool-pz512 <none>
    0   381 W 283297216  32768 zpool-pz512 <none>
 2903 28881 R 256458773   7168 thunderbird <none>
 2903 28881 R 256795291   6656 thunderbird <none>
    0   381 W 322684424   4096 zpool-pz512 <none>

BUT, opensnoop showed guilty processes: firefox and thunderbird (which explains no data increase, when logged off): Example

2903 28883 firefox 53 /var/cache/fontconfig/d937d800-0615-4b33-a228-a4e53ca4493d-le32d4.cache-7 2903 28883 firefox 53 /var/cache/fontconfig/1b72084f-f43d-4fe7-dc05-bc8f25d5a89a-le32d4.cache-7 2903 28883 firefox 53 /var/cache/fontconfig/5f5cc031-6c85-e44b-fe60-d8796ef92dee-le32d4.cache-7 2903 28883 firefox -1 /var/cache/fontconfig/e94921fa-8699-e522-ac57-c327d7aeaed2-le32d4.cache-7 2903 28883 firefox -1 /var/cache/fontconfig/e94921fa-8699-e522-ac57-c327d7aeaed2-le32d4.cache-7 2903 28883 firefox 53 /var/cache/fontconfig/e94921fa-8699-e522-ac57-c327d7aeaed2-le32d4.cache-7.TMP-GMSyA4 2903 28883 firefox 53 /var/cache/fontconfig/e94921fa-8699-e522-ac57-c327d7aeaed2-le32d4.cache-7.NEW

Also, opensnoop shows that firefox tries 2 more directories:
$ grep 222d5260-f64f-4732-87f3-f79737a2876a-le32d4 /tmp/opensnoop.txt
2903 28883 firefox -1 /var/cache/fontconfig/222d5260-f64f-4732-87f3-f79737a2876a-le32d4.cache-7 2903 28883 firefox -1 /export/home/predrag_zecevic/.cache/fontconfig/222d5260-f64f-4732-87f3-f79737a2876a-le32d4.cache-7 2903 28883 firefox -1 /export/home/predrag_zecevic/.fontconfig/222d5260-f64f-4732-87f3-f79737a2876a-le32d4.cache-7 2903 28883 firefox -1 /var/cache/fontconfig/222d5260-f64f-4732-87f3-f79737a2876a-le32d4.cache-7 2903 28883 firefox -1 /export/home/predrag_zecevic/.cache/fontconfig/222d5260-f64f-4732-87f3-f79737a2876a-le32d4.cache-7 2903 28883 firefox -1 /export/home/predrag_zecevic/.fontconfig/222d5260-f64f-4732-87f3-f79737a2876a-le32d4.cache-7 2903 28883 firefox 53 /var/cache/fontconfig/222d5260-f64f-4732-87f3-f79737a2876a-le32d4.cache-7.TMP-iMSyA4 2903 28883 firefox 53 /var/cache/fontconfig/222d5260-f64f-4732-87f3-f79737a2876a-le32d4.cache-7.NEW

One of them does not exists, but second one has content:

$ du -shc /export/home/predrag_zecevic/.cache/fontconfig/ /export/home/predrag_zecevic/.fontconfig
1,5M    /export/home/predrag_zecevic/.cache/fontconfig/
du: cannot access '/export/home/predrag_zecevic/.fontconfig': No such file or directory
1,5M    total

$ ls -alrthd /export/home/predrag_zecevic/.cache/fontconfig/* | tail -4
-rw-r--r-- 1 predrag_zecevic admin 113K Mar 14 2016 /export/home/predrag_zecevic/.cache/fontconfig/c4eda28aefebeb36dd28598006088ed1-le64.cache-4 -rw-r--r-- 1 predrag_zecevic admin 114K Mar 14 2016 /export/home/predrag_zecevic/.cache/fontconfig/d4f9a910920d402be1110037f89e03ac-le64.cache-4 -rw-r--r-- 1 predrag_zecevic admin 113K Mar 14 2016 /export/home/predrag_zecevic/.cache/fontconfig/fde37821cbdb1159b4eac7aa64d92051-le64.cache-4 -rw-r--r-- 1 predrag_zecevic admin 113K Mar 14 2016 /export/home/predrag_zecevic/.cache/fontconfig/cabbd14511b9e8a55e92af97fb3a0461-le64.cache-4


So, that cache file is from 2016.

Any suggestion?

With best regards.
Predrag Zečević
--
Predrag Zečević
Technical Support Analyst
2e Systems GmbH

tel: +49 - 6196 - 95058 - 15
mob: +49 - 174 - 3109288
fax: +49 - 6196 - 95058 - 94
e-mail: predrag.zece...@2e-systems.com

headquarter: 2e Systems GmbH, Koenigsteiner Str. 87, 65812 Bad Soden am Taunus, Germany
registration: Amtsgericht Koenigstein (Germany), HRB 7303
managing director: Phil Douglas

http://www.2e-systems.com/ - Making your business fly!

_______________________________________________
openindiana-discuss mailing list
openindiana-discuss@openindiana.org
https://openindiana.org/mailman/listinfo/openindiana-discuss

Reply via email to