Help request to figure out why disk is full

NethServer Version: NS8
Module: Core

This afternoon I started getting alerts that my NS8 is running out of space. NS8 is running in a VM on an SSD with 80GB. There data files are all on a separate drive with 500GB space. It is the SSD that is now overflowing apparently. Since I have only have minimum on the SSD, I’m surprised that I’m getting a disk space error.

It’s been running along pretty well for a few weeks. Yesterday I did a core update and another this evening. The following error started showing up this afternoon and continues with the last core update.

Here is the error:

# du -h -d 1 /home | sort -hr
75G	/home
46G	/home/loki1
13G	/home/roundcubemail1
9.5G	/home/mail1
6.5G	/home/metrics1
675M	/home/traefik1
196M	/home/ldapproxy1
16K	/home/administrator

What I don’t understand is why loki1 is 46GB!!

# runagent -m loki1 podman system df
TYPE           TOTAL       ACTIVE      SIZE        RECLAIMABLE
Images         4           3           336.8MB     78.86kB (0%)
Containers     3           3           101.1MB     0B (0%)
Local Volumes  1           1           46.59GB     0B (0%)
#  df -i /run/user/$(id -u loki1)
Filesystem     Inodes IUsed  IFree IUse% Mounted on
tmpfs          306192    95 306097    1% /run/user/1004
# runagent -m loki1 podman system df
TYPE           TOTAL       ACTIVE      SIZE        RECLAIMABLE
Images         4           3           336.8MB     78.86kB (0%)
Containers     3           3           101.1MB     0B (0%)
Local Volumes  1           1           46.59GB     0B (0%)
# du -h -d 1 /home/loki1 | sort -hr
46G	/home/loki1/.local
46G	/home/loki1
164K	/home/loki1/.config
# du -h -d 1 /home/loki1/.local/share/containers/storage/volumes/ | sort -hr
44G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data
44G	/home/loki1/.local/share/containers/storage/volumes/
# du -h -d 1 /home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/ | sort -hr
44G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks
44G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/
28K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/tsdb-index_cache
20K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/tsdb-index
16K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/boltdb-shipper-compactor
4.0K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/boltdb-shipper-active
0	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/rules-temp
0	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/rules
0	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/boltdb-shipper-cache

My suspicion is the default loki retention has filled up the disk so I reduced the default (was 365) to 180 days. I think that is probably too much too. But that hasn’t fixed the issue and the disk usage is still at 46GB.

Edit:

I reduced the loki retention to 7 days in an attempt to clear out all the garbage. I waited 10 min which I believe is the compaction interval (I may be mistaken)

Then I rebooted the NS8 VM but it didn’t do anything.

I’ve looked at everything I can figure out but am now stuck.
Any suggestions on how to debug and fix this before everything blows up is appreciated!

1 Like

Here are what looks like the culprits

# du -h -d 1 /home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/ | sort -hr
40G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/
11G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/fa49211e29580995
9.1G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/eb7d732a19b91c88
9.1G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/4c1c460af889e10c
5.4G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/d8d9ee0630a3a5f2
3.8G	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/9f9e67b7bf2b6420
387M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/4157a6dc104452a5
358M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/4991baf894c0097f
143M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/abc87624820d5bc0
138M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/8de5e37ef660d4fd
111M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/4a9de79619de2166
28M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/c1c78a77bff89774
18M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/fa3c29f8985f1c
15M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/91589fc8dad30724
8.1M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/ca997859ce5c99b7
7.0M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/3623dbfe62d735f2
5.9M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/66161cdda38f3dcb
5.6M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/d6ff4f8a1ff3c094
2.4M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/f9a97a2660469e81
2.4M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/f32da0c2ad27f35e
2.4M	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/61aa4aa986ced9ae
832K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/38a09ab8f07fa90e
828K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/45231c4777bc02d7
696K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/3706efbbc5c9868
692K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/a3c7a30e35237965
648K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/bde1b499c30b0a72
452K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/935f4901dd9d8a32
136K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/e47ec62a2236bee9
56K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/e362cfbbc0a41262
48K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/2940daa376de4c09
40K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/bdd31f5cb176e0ca
40K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/304edc6c3ccd469
24K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/53a214b524ab8fa6
24K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/2e9bb2eca10b0380
8.0K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/45a51ff682edfd70
4.0K	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/8cd3cec3d98d49c3 

One more addition that might help.

It looks like the retention is set to 30 days despite using the Cluster Admin GUI and setting to 7 days.

# api-cli run module/loki1/get-configuration
Warning: using user "cluster" credentials from the environment
{"retention_days": 30, "active_from": "2025-03-28T10:54:38.948295-04:00", "cloud_log_manager": {"cluster_id": "cluster-XXXXXXX", "status": "inactive", "address": "", "tenant": "", "filter": "", "last_timestamp": ""}, "syslog": {"status": "inactive", "address": "", "port": "", "protocol": "", "filter": "", "format": "", "last_timestamp": ""}}

???

Not sure what actually fixed the issue but the disk usage is now around 50%. Perhaps the retention to 7 days finally caused the compactor to delete all the old log files.

I’d still like to know how this happened and what I should be doing to make sure the logs aren’t growing too large.

Check the relevant Loki environment values with this command:

runagent -m loki1 grep -E '(RET|V13)' environment

Environment variables are passed to Loki’s configuration. You can see its template with:

runagent -m loki1 cat ../loki-config.yaml

Then Loki’s retention documentation page should explain how it works. I admit it’s kind of magic to me! Some considerations:

  • TSDB storage started being used from a certain point. You can find that exact point in your environment file. See its storage dirs with:

     runagent -m loki1 podman exec loki-server ash -c 'ls -lt /loki/chunks/fake | tail'
    

    Despite its strange name, “fake” is the usual dir of TSDB storage, introduced to keep it separate from previous files.

  • The compactor reclaims disk space after a while (30 minutes?).

  • I checked a production system and seems the disk file timestamps of old BoltDB files (under the container’s /loki/chunks dir) still match the expected retention time. You can look at them with:

     runagent -m loki1 podman exec loki-server ash -c 'ls -lt /loki/chunks | tail'
    
3 Likes

Thank you @davidep .

I’ll be running those commands when I get back from work. I had a quick look at the retention this morning and it is set to 30 days again. I set it to 7 days last night in my clean up attempt. I’m wondering how it ended up at 30 days since I didn’t set it. Does the system have a 30 day default that gets reset somehow?

No, a quick code search shows there’s no 30 used as a fallback or default. Instead, 365 is assumed only if the environment variable LOKI_RETENTION_PERIOD is completely missing. However, that variable is set when the module is created. You can verify it with the commands from the previous comment.

1 Like

Thank you @davidep .

Today everything continues to be well behaved. My VM SSD /dev/sda1 has grown a few percent since last night. It’s 54% usage now.
I see that loki file are much less but still 17GB. That seems pretty high for logs but I’m new to NS8.

The chunk/fake files are 1x Aug 3, 1x Aug 4 and the rest Aug 28.

# du -h --time -d 1 /home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/ | sort -hr
17G	2025-08-28 22:45	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/
4.9G	2025-08-28 22:45	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/eb7d732a19b91c88
4.9G	2025-08-28 22:45	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/4c1c460af889e10c
3.7G	2025-08-28 21:55	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/fa49211e29580995
1.6G	2025-08-28 22:45	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/d8d9ee0630a3a5f2
1.2G	2025-08-28 22:45	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/9f9e67b7bf2b6420
263M	2025-08-28 22:15	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/4157a6dc104452a5
232M	2025-08-28 22:30	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/4991baf894c0097f
34M	2025-08-28 22:05	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/8de5e37ef660d4fd
32M	2025-08-28 22:30	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/abc87624820d5bc0
27M	2025-08-28 22:30	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/4a9de79619de2166
12M	2025-08-28 22:30	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/c1c78a77bff89774
4.8M	2025-08-28 22:36	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/fa3c29f8985f1c
3.8M	2025-08-28 21:45	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/91589fc8dad30724
2.9M	2025-08-28 22:40	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/ca997859ce5c99b7
2.7M	2025-08-28 22:26	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/3623dbfe62d735f2
1.4M	2025-08-28 21:30	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/d6ff4f8a1ff3c094
1.4M	2025-08-28 21:17	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/66161cdda38f3dcb
1.2M	2025-08-27 22:00	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/f9a97a2660469e81
1.2M	2025-08-27 22:00	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/f32da0c2ad27f35e
1.2M	2025-08-27 22:00	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/61aa4aa986ced9ae
316K	2025-08-27 22:01	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/45231c4777bc02d7
316K	2025-08-27 22:01	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/38a09ab8f07fa90e
256K	2025-08-27 22:00	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/bde1b499c30b0a72
192K	2025-08-27 22:00	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/935f4901dd9d8a32
148K	2025-08-27 22:01	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/a3c7a30e35237965
148K	2025-08-27 22:01	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/3706efbbc5c9868
60K	2025-08-27 22:00	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/e47ec62a2236bee9
36K	2025-08-27 22:01	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/e362cfbbc0a41262
24K	2025-08-04 15:58	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/53a214b524ab8fa6
24K	2025-08-03 02:19	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/2e9bb2eca10b0380
20K	2025-08-27 22:20	/home/loki1/.local/share/containers/storage/volumes/loki-server-data/_data/chunks/fake/2940daa376de4c09 

When I look at the loki log I find the following being added to the log every second:

2025-08-28T22:38:03-04:00 [1:loki1:loki-server] level=error ts=2025-08-29T02:38:03.040091132Z caller=manager.go:50 component=distributor path=write msg="write operation failed" details="Ingestion rate limit exceeded for user fake (limit: 4194304 bytes/sec) while attempting to ingest '316' lines totaling '1045994' bytes, reduce log volume or contact your Loki administrator to see if the limit can be increased" org_id=fake
2025-08-28T22:38:03-04:00 [1:loki1:loki-server] level=error ts=2025-08-29T02:38:03.797532429Z caller=manager.go:50 component=distributor path=write msg="write operation failed" details="Ingestion rate limit exceeded for user fake (limit: 4194304 bytes/sec) while attempting to ingest '316' lines totaling '1048270' bytes, reduce log volume or contact your Loki administrator to see if the limit can be increased" org_id=fake

I’m guessing here but it looks like there is some config issue and so the logs build and build with errors.

I will need to spend some time reading the Loki retention documentation page and looking into why I have this error every second. Always something new to figure out. :grinning:

I’m changing the retention to 7 days again and will look in the morning. I hope the logs will be more reasonable when I look next.

With log retention set to 7 days, my VM SSD disk is now at 36%.

So it appears that the log issue or config is causing extraordinarily large files to accumulate.

I’ll be digging in a bit more over the weekend.

1 Like