Same as FTL log disk usage
I'm continuing the thread. (Man I hate Discourse thread auto-close feature.)
I constantly get below Pi-Hole alert message:
Disk shortage (/var/log/pihole-FTL.log) ahead: 99% used
/var/log: 101.5MB used, 101.5MB total
Details about my system:
Pi-Hole installed directly on host Armbian bullseye.
Issue details
(N.B. Before today I did not know (and still not sure) what is zram. How I understand it is that it seems to compress things in memory and to also act as would log2ram, which uses ram as a buffer and only when full writes down content into a physical file. Anyways...)
I tried to enlarge /var/log zram size from 50 MB to 100 MB as I thought that if I made it bigger maybe it would be enough to allow for the Pihole log file to grow without reaching that limit until the next log rotate. Maybe I get this totally wrong and don't understand the concept, or maybe I kind of get it but that 100 MB is simply not enough for the Pihole log file.
In the above reference thread another user suggested to either disable persistent journal log or to disable Armbian's zram log.
But would that just mean avoid resolving the problem by simply not logging things or to accept wearing off the sdcard prematurely ?
If I get it correctly then could someone enlighten me on a real possible solution?
And side question. Is it really a problem to get those alerts or is the worst they do is it to annoy me with that jumping exclamation mark icon ?
Disabling zram would again store logs to your sd card instead of RAM.
That way, you wouldn't lose log file content on power-downs or once they are rotated away (I guess those zram logs to be cleared regularly, perhaps daily).
Pi-hole keeps logs for a certain number of days, and we sometimes ask users to retrieve data from those logs when trouble-shooting. This may potentially be less effective with only a day's worth of log file data.
Regarding sd card wearage, this is less of an issue than it used to be, as sd cards became both more reliable and bigger, where the latter helps with wear leveling. And they also are cheaper than a few years ago.
Personally, I'd opt for permanent storage, but that really is a personal choice.
However, if you would then see your sd card usage growing quickly (as in GBytes per day), then there may indeed be an underlying issue (e.g. a DNS loop) that you should also address.
Did not try to yet. From my understanding, if zram is there by default it's because it has a purpose.
To say that the solution is to remove it was from my point of view like saying to remove a firewall because you don't understand that you could open a port in it.
But then again, if it's the real solution and not like my firewall example, then I could maybe just do that.
To loose logs on power-downs is not a problem as it seldom never happens. Also, I thought that zram would keep logs in memory and only write to file when either logs are rotated by Pi-Hole or when log filesize limit is reached.
In the end, all I'm trying to do is to have that working without throwing an error and wearing off my sdcard.
Last time I bought a sdcard (and thus the one I have) was 7-8 years ago. I don't care buying a new one, but I care about not loosing my time reparing my network and the trouble to get a new card.
I might just install Pi-Hole on my main server then...
What do you have in mind there? In which case? Not sure to follow.
In the end, the question still is: is there a way to make Pi-Hole work with Zram without throwing errors?
I guess to better understand another question I would have is: how large the Pi-Hole logs usually get in a "normal" (whatever that could mean) usage scenario during a 72 hrs timeframe?
Oh and I still have my side question that is: Is it really a problem to get those alerts or is the worst they do is it to annoy me with that jumping exclamation mark icon ?
Sorry, I mistook you for the other topic's OP, as you said you'd continue it.
That would be switching the entire platform, not just storage.
No.
Your OS is using one specific file system for a given mount.
If you mount your /var/log to a memory-based file system, its contents will be volatile, and its size will be limited by allocated RAM.
Allocate enough memory to hold your personal average amount of data.
There can be no guarantee that occasional peaks in DNS traffic wouldn't exhaust available memory, though. zram makes it a bit tricky to guess how much memory it actually would need, as compression does not work equally well across all data.
You are the only one who can provide the answer to this, as that depends on the number and DNS chattiness of your clients (and also the amount of other software running on your Pi-hole host machine).
Switch off zram for a period of 5 days or so and note down how large your /var/log/ folder structure has grown, apply a safety margin and use that value for the size of your in-memory filesystem.
That has been answered already:
You are potentially stripping yourself from the ability to analyse the cause for issues that you may encounter.