telegraf unbound causes pfblocker logs to keep growing in size

[vajonam]

I am seeing an issue that is being discussed here.

https://www.reddit.com/r/pfBlockerNG/comments/md1kli/pfblocker_using_up_disk_space_over_a_few_days/

Originally I thought it was to do w/ pfblocker but it seems to do with thee telegraf log tail/parser that is keeping the files open and not let it be deleted. What ends up happening is a difference between df and du commands. restart pfblocker everything resets. Restarting telegraf doesn't seem to help.

this is what lsof shows.

telegraf  40308    root    8r    VREG              0,113             544148  802630 /var/log/pfblockerng/dnsbl.log
telegraf  40308    root   10r    VREG              0,113             544148  802630 /var/log/pfblockerng/dnsbl.log
telegraf  40308    root   13r    VREG              0,113             703086  802608 /var/log/pfblockerng/ip_block.log
telegraf  40308    root   17r    VREG              0,113             703086  802608 /var/log/pfblockerng/ip_block.log

removing the telegraph log tail from the additional config seems to fix it.

Are you running into this? this is with pfblocker_devel (latest) and pfsense 2.5.0. Any ideas what I can do here?

[vajonam]

    $df -m /
    Filesystem                                      1M-blocks Used Avail Capacity  Mounted on
    /dev/gptid/6f34ba9a-3faa-11ea-bfde-40623108486d     13683 3328  9260    26%    /

This shows 3328 megs used

and when running DU. this shows differences!

    $cd / && du -ma | sort -nr | head -n 20

    2124    .
    1227    ./usr
    851 ./usr/local
    605 ./var
    512 ./var/unbound
    474 ./var/unbound/usr/local
    474 ./var/unbound/usr
    316 ./var/unbound/usr/local/lib
    316 ./usr/local/lib
    298 ./usr/lib
    249 ./usr/local/share
    207 ./boot
    132 ./boot/kernel.old
    130 ./var/unbound/usr/local/lib/python3.7
    130 ./usr/local/lib/python3.7
    115 ./var/unbound/usr/local/bin
    115 ./usr/local/bin
    113 ./usr/lib/debug
    102 ./usr/local/sbin
    82  ./var/db

As you can see du reports 2124 megs used and df reports 3328

[vajonam]

Think this is due the telegraf_unbound.sh .. have moved over to the lite stuff now. will provide an update shortly.

[vajonam]

Yup definitely due to the telegraph_unbound.sh, not sure if this is related to python mode and the pfblocker. but switching to unbound_lite seemed to fix this issue.