Why has reserved space on ext4 uid of filebeat?

Elastic Stack Beats
1

Hi,

Version: 7.5.2

Filebeat is running as unprivileged user filebeat as systemd service.

we noticed the following on our servers:

sudo tune2fs -l -u filebeat /dev/mapper/vg_root-root | grep -i reserved
Setting reserved blocks uid to 2507
Reserved block count:     731340
Reserved GDT blocks:      1024
Reserved blocks uid:      2507 (user filebeat)
Reserved blocks gid:      0 (group root)

sudo tune2fs -l -u root /dev/mapper/vg_root-root | grep -i reserved
Setting reserved blocks uid to 0
Reserved block count:     731340
Reserved GDT blocks:      1024
Reserved blocks uid:      0 (user root)
Reserved blocks gid:      0 (group root)
[aschampe@elastic01 ~]$ sudo tune2fs -l -u root /dev/mapper/vg_root-root | grep -i reserved

So filebeat can use the reserved space and root has nothing reserved.

Can you explain why reserved blocks uid is set to filebeat's uid instead of root?
How can I prevent this?

Thanks, Andreas

2

forget it. Wrong usage of tune2fs. -u option is setting the user, not filtering for that.
So no issue with filebeat, just a lack of knowledge with tune2fs :wink:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.