[SOLVED] jbd2/sda1-8 What exactly is this process that keeps running every few seconds?

damgar · 02-12-2010, 09:12 PM

I'm trying to figure out what this process is that pops up when I run

PHP Code:



top -i

every few seconds

PHP Code:



jbd2/sda1-8

The best info I've found so far says it might be something to do with ext4 journaling, but I've never seen this before. I'm running 2.6.33-rc5 if that might have something to do with it. Further the process hasn't been popping up for the last 10 minutes or so, but previously it was occuring every 2 or 3 seconds repeatedly for a minute or so.

neonsignal · 02-12-2010, 09:34 PM

The JBD is the journaling block device that sits between the file system and the block device driver. The jbd2 version is for ext4, as you found. If you are seeing a lot of activity when nothing much is running, check if any of the logs are getting a lot of updates.

jaimesilva · 09-10-2010, 06:44 PM

And how do I find if a log is getting a lot of activity? There are many of them !

Thanks

neonsignal · 09-10-2010, 09:57 PM

Quote:

Originally Posted by jaimesilva

And how do I find if a log is getting a lot of activity? There are many of them !

As a first pass, just have a look if there are any abnormally large logs. Something like the following will show you which logs are the biggest:

Code:

ls -lS /var/log/*log | head

If there are any that are larger than a few megabytes, use tail to look at the end of them and see if there are any errors that are occurring frequently.

Of course, the disk activity might be caused by something other than writing to logs, so this is just one thing to look at.

lfcfan · 10-04-2012, 01:17 PM

Hi Neonsignal (and the others).
Could you please let me know how to investigate my log files using tail ?
Here is the result of the command above :

Code:

Myaccount@Mycomuputer:~$ ls -lS /var/log/*log | head
-rw-r----- 1 syslog adm  10636287 2012-10-04 14:05 /var/log/kern.log
-rw-r----- 1 syslog adm   1400996 2012-10-04 14:05 /var/log/syslog
-rw-r----- 1 syslog adm    534842 2012-10-04 14:05 /var/log/auth.log
-rw-rw-r-- 1 root   utmp   292292 2011-10-23 03:07 /var/log/lastlog
-rw-r--r-- 1 root   root   112244 2012-10-04 13:47 /var/log/pm-powersave.log
-rw-r--r-- 1 root   root    49835 2012-02-01 23:17 /var/log/wifi-radar.log
-rw-r--r-- 1 root   root    49092 2011-10-12 11:08 /var/log/bootstrap.log
-rw-r--r-- 1 root   root    32605 2012-10-04 13:46 /var/log/Xorg.0.log
-rw-r--r-- 1 root   root    24024 2011-10-23 03:07 /var/log/faillog
-rw-r--r-- 1 root   root    21767 2012-10-04 14:00 /var/log/dpkg.log

My kern.log seems to be huge, what do you think ?

mjlush · 10-13-2015, 10:23 AM

watch ls -l

will run ls -l every 2 seconds so you should be able to see which log files are being added to

jk04 · 07-17-2017, 12:03 AM

These are the steps (commands: observations) that I took:

iotop -oPa -d 2: High I/O on /var partition
glances: High iowait and load
iostat -2: /var high I/O confirmation
ls -lhS /var/log/*log | head: Large mail.log
tail -f /var/log/mail.log: Rapid, continuous logging

In this particular case, the culprit turned out another mailserver which did not accept mail causing local server logging activities on resending messages from a huge queue and notifying senders of delivery delays.