# Why has reserved space on ext4 uid of filebeat?

**URL:** <https://discuss.elastic.co/t/why-has-reserved-space-on-ext4-uid-of-filebeat/227157>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 8, 2020, 2:59pm UTC](https://discuss.elastic.co/t/why-has-reserved-space-on-ext4-uid-of-filebeat/227157 "2020-04-08T14:59:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [April 8, 2020, 2:59pm UTC](https://discuss.elastic.co/t/why-has-reserved-space-on-ext4-uid-of-filebeat/227157/1 "2020-04-08T14:59:40Z")

</div>

Hi,

Version: 7.5.2

Filebeat is running as unprivileged user `filebeat` as systemd service.

we noticed the following on our servers:

```
sudo tune2fs -l -u filebeat /dev/mapper/vg_root-root | grep -i reserved
Setting reserved blocks uid to 2507
Reserved block count: 731340
Reserved GDT blocks: 1024
Reserved blocks uid: 2507 (user filebeat)
Reserved blocks gid: 0 (group root)

sudo tune2fs -l -u root /dev/mapper/vg_root-root | grep -i reserved
Setting reserved blocks uid to 0
Reserved block count: 731340
Reserved GDT blocks: 1024
Reserved blocks uid: 0 (user root)
Reserved blocks gid: 0 (group root)
[aschampe@elastic01 ~]$ sudo tune2fs -l -u root /dev/mapper/vg_root-root | grep -i reserved

```

So filebeat can use the reserved space and root has nothing reserved.

Can you explain why `reserved blocks uid` is set to filebeat's uid instead of root?  
How can I prevent this?

Thanks, Andreas

---

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [April 9, 2020, 7:28am UTC](https://discuss.elastic.co/t/why-has-reserved-space-on-ext4-uid-of-filebeat/227157/2 "2020-04-09T07:28:24Z")

</div>

forget it. Wrong usage of tune2fs. -u option is setting the user, not filtering for that.  
So no issue with filebeat, just a lack of knowledge with tune2fs 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2020, 7:28am UTC](https://discuss.elastic.co/t/why-has-reserved-space-on-ext4-uid-of-filebeat/227157/3 "2020-05-07T07:28:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.