· about 20 minutes · runs on ubuntu-26.04, alpine · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
The ledger service writes its transaction log to its own filesystem, mounted at
/var/log/app. This morning it reported the disk full.
An hour ago a colleague deleted the biggest file they could find there. df still says the
filesystem is almost full. du says there is hardly anything in it. The colleague went home.
What is expected, and graded:
You have root through sudo. Everything must still hold after a reboot.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_log_disk_has_space | Find what is using disk space when df and du disagree |
| 02_no_deleted_files_held_open | Find what is using disk space when df and du disagree |
| 03_logrotate_covers_app | Configure log rotation so a service cannot fill its disk again |
| 04_ledger_still_running | Fix the cause without taking the service down |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
man 1 dfman 1 duman 8 lsofman 5 procman 8 logrotate3 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Here they are, to answer in place:
df reports 95% used; du on the same mount adds up to 10%. What is the most likely reason?
Deleted files are still held open by running processes
du walks names; df asks the filesystem about blocks. Blocks of an unlinked but open file are used and nameless. lsof +L1 finds them. (Files hidden under a mount point cause the same gap.)
man 1 du · man 1 df · man 8 lsof
What does logrotate's copytruncate do?
Copies the log, then truncates the original in place, so the writer keeps its open file
It suits programs that cannot reopen their log. The alternative — rename, then postrotate signals the program to reopen — avoids the small window where lines written between copy and truncate are lost.
man 8 logrotate
Which command tests a logrotate configuration without rotating anything?
logrotate -d /etc/logrotate.d/app
-d is debug mode and implies a dry run. -f forces a rotation; -v rotates verbosely; --state names the state file.
man 8 logrotate