Samba: syslog-ng disk buffers accumulate after container recreation

[nrauso]

The Samba container stores syslog-ng disk-buffer files in the persistent /var/lib/samba volume, while syslog-ng.persist is kept in the non-persistent container filesystem.
When the container is recreated, the persist file is lost but the .qf files remain, causing orphan disk buffers to accumulate over time.
Since each buffer is preallocated to 100 MiB, this can lead to significant disk usage and unnecessarily increase backup size.

Steps to reproduce

• Install a NethServer 8 Samba instance providing Active Directory and file server services
• Let the Samba container run and generate audit events
• Recreate or update the Samba container multiple times
• Check the disk usage of the persistent syslog-ng disk-buffer directory:

du -sh /var/lib/samba/syslog-ng/

On an affected installation, the directory reached:

56G /var/lib/samba/syslog-ng/

The directory contained hundreds of preallocated disk-buffer files:

syslog-ng-00000.qf
syslog-ng-00001.qf
...
syslog-ng-00567.qf

Each file was about 100 MiB.

Checking the syslog-ng persist file:

persist-tool dump /var/lib/syslog-ng/syslog-ng.persist

only the latest disk-buffer was referenced:

afsql_dd(pgsql,127.0.0.1,15432,samba_audit,samba_audit) = {
    "value": "... /var/lib/samba/syslog-ng/syslog-ng-00567.qf "
}

and checking older disk-buffer files with dqtool:

dqtool info /var/lib/samba/syslog-ng/syslog-ng-00000.qf
dqtool info /var/lib/samba/syslog-ng/syslog-ng-00566.qf

all 567 unreferenced disk-buffer files were empty:

number_of_messages='0'

Expected behavior

The syslog-ng persist state and its disk-buffer files should survive container recreation consistently.

Container recreation or application updates should not leave orphan .qf disk-buffer files in /var/lib/samba/syslog-ng/.

The directory should normally contain only the disk-buffer files currently referenced by syslog-ng and should not continuously increase its disk usage after container recreation.

Actual behavior

The disk-buffer files are stored in the persistent /var/lib/samba volume, while syslog-ng.persist is stored in the non-persistent container overlay filesystem.

When the container is recreated:

• the existing .qf disk-buffer survives;
• syslog-ng.persist is lost;
• syslog-ng creates a new .qf disk-buffer;
• the previous .qf becomes orphaned and is never removed.

Since disk-buffer preallocation is enabled and each .qf reserves about 100MB, repeated container recreations can cause a significant amount of unused disk space to accumulate.

On the affected installation, 567 orphan disk-buffer files occupied about 56 GB.
All orphan queues contained zero messages.

After removing the orphan queues, disk usage decreased from 56GB to 101MB.

This has an additional impact because /var/lib/samba is part of the persistent application data and is therefore also included in backups.

A possible fix is to store syslog-ng.persist in the same persistent volume as the disk-buffer, for example by starting syslog-ng with:

syslog-ng -F --no-caps --persist-file /var/lib/samba/syslog-ng/syslog-ng.persist

This would keep the persist state and the .qf disk-buffer together across container recreation without making runtime files such as the syslog-ng PID and control socket persistent.

Components

• samba:3.4.8