# newsyslog and zfs compression problem, possible bug



## chrcol (Aug 4, 2010)

On a server that uses zfs with lzjb compression we recently noticed that logs that should rotate on size are not been rotated, after running newsyslog -v it is evident newsyslog thinks the logs are smaller than what they are.  I upgraded it to 8.1 RELEASE (was 8.0-STABLE) but the problem remained and we changed to daily rotation.  Then I thought hmm maybe reading the compressed size so I did the following test with xferlog (large log that set to rotate when 1meg in size, actual size 2.1 meg not rotated.

1 - I disabled compression on the filesystem.
2 - I copied xferlog to xferlog2 which meant xferlog2 not compressed.
3 - added an entry in newsyslog.conf for xferlog2, same setting as xferlog.
4 - ran newsyslog -v

it reported this.


```
# ls -l xfer*
-rw-------  1 root  wheel  2214947 Aug  4 14:48 xferlog
-rw-------  1 root  wheel  2214947 Aug  4 16:58 xferlog2

# newsyslog -v
<snip>
/var/log/xferlog <7J>: size (Kb): 393 [1000] --> skipping
/var/log/xferlog2 <7J>: size (Kb): 2180 [1000] --> trimming log....
<snip>
```

I repeated it after turning it back on again and it reported the wrong size.


----------



## phoenix (Aug 6, 2010)

Simple solution:  either disable compression on the logs filesystem, or don't rotate based on size.  

IOW, if you really want to rotate based on size (why?), choose where you want the compression to happen:  while live, or during rotation.


----------



## chrcol (Aug 6, 2010)

Know the workaround, I am more reporting the bug here.


----------



## phoenix (Aug 6, 2010)

Ah, gotcha.  

Wonder how OSol handles this?  Do they have separate "actual size on disk (number of blocks used)" vs "relative (uncompressed) size" stats?


----------



## chrcol (Aug 6, 2010)

I guess I should do a PR on this also  was been lazy.


----------

