sys-whonix: volume private is 94.7% full
Is this just the normal progression of a codebase getting bigger, or is something wrong here?
Check what’s consuming the space there using this command in sys-whonix terminal:
sudo du -h /rw | sort -h
Two things have changed.
-
I doubled the space in Qubes Settings - figured it couldn’t hurt.
-
There were updates available for the whonix qubes, so I updated them (via Qubes Updater Tool).
Error message is gone, but that still doesn’t say much.
Running your du command, the output is:
4.0K /rw/bind-dirs/var/cache/anon-base-files
4.0K /rw/bind-dirs/var/cache/setup-dist/status-files
4.0K /rw/bind-dirs/var/lib/systemcheck
4.0K /rw/bind-dirs/var/lib/tor/authdir
4.0K /rw/bind-dirs/var/lib/tor/keys
4.0K /rw/bind-dirs/var/lib/tor/pt_state
4.0K /rw/bind-dirs/var/lib/whonix/do_once
4.0K /rw/bind-dirs/var/spool/cron/crontabs
4.0K /rw/home/user/.cache/mesa_shader_cache
4.0K /rw/home/user/Desktop
4.0K /rw/home/user/Documents
4.0K /rw/home/user/.local/share/Bisq/btc_mainnet/tor
4.0K /rw/home/user/Music
4.0K /rw/home/user/Public
4.0K /rw/home/user/Templates
4.0K /rw/home/user/Videos
4.0K /rw/usrlocal/bin
4.0K /rw/usrlocal/games
4.0K /rw/usrlocal/include
4.0K /rw/usrlocal/lib/pypy2.7/dist-packages
4.0K /rw/usrlocal/lib/python3.9/dist-packages
4.0K /rw/usrlocal/sbin
4.0K /rw/usrlocal/share/ca-certificates
4.0K /rw/usrlocal/share/man
4.0K /rw/usrlocal/share/zsh/site-functions
4.0K /rw/usrlocal/src
8.0K /rw/bind-dirs/var/cache/setup-dist
8.0K /rw/bind-dirs/var/lib/whonix
8.0K /rw/bind-dirs/var/spool/cron
8.0K /rw/home/user/.config/tox
8.0K /rw/home/user/.config/vlc
8.0K /rw/home/user/.config/xfce4/panel/launcher-5
8.0K /rw/home/user/.config/xfce4/panel/launcher-6
8.0K /rw/home/user/.config/xfce4/panel/launcher-7
8.0K /rw/home/user/.dbus/session-bus
8.0K /rw/home/user/Downloads
8.0K /rw/home/user/.local/share/Bisq/btc_mainnet
8.0K /rw/home/user/Pictures
8.0K /rw/usrlocal/lib/pypy2.7
8.0K /rw/usrlocal/lib/python3.9
8.0K /rw/usrlocal/share/fonts
8.0K /rw/usrlocal/share/zsh
12K /rw/bind-dirs/var/lib/sdwdate
12K /rw/bind-dirs/var/spool
12K /rw/home/user/.cache/fontconfig
12K /rw/home/user/.config/gtk-4.0
12K /rw/home/user/.config/xfce4/terminal
12K /rw/home/user/.dbus
12K /rw/home/user/.local/share/Bisq
12K /rw/usrlocal/etc/torrc.d
16K /rw/bind-dirs/var/cache
16K /rw/config
16K /rw/lost+found
16K /rw/usrlocal/etc
20K /rw/home/user/.cache
20K /rw/usrlocal/lib
24K /rw/home/user/.config/hexchat
24K /rw/home/user/.gnupg
24K /rw/home/user/.xchat2
28K /rw/usrlocal/share
32K /rw/bind-dirs/var/lib/canary
36K /rw/home/user/.config/xfce4/panel
40K /rw/home/user/.config/xfce4/xfconf/xfce-perchannel-xml
44K /rw/home/user/.config/xfce4/xfconf
64K /rw/home/user/.local/share/xorg
80K /rw/home/user/.local/share
84K /rw/home/user/.local
88K /rw/usrlocal
96K /rw/home/user/.config/xfce4
160K /rw/home/user/.config
444K /rw/home/user
448K /rw/home
37M /rw
37M /rw/bind-dirs
37M /rw/bind-dirs/var
37M /rw/bind-dirs/var/lib
37M /rw/bind-dirs/var/lib/tor
From some web searches, I gather that the last file, ...var/lib/tor is how Tor keeps a persistent state across restarts. Most search hits talk about issues with file permissions.
In Qubes its been put into bind-dirs directory for ease of persistance in the unique Qubes structure, some years ago.
But that doesn’t tell me what size it should be (or at least should have been before the update).
Basically, I still don’t know if I should worry here.
Right now it seems that it’s not out of space anymore and the files that were occupying the free space were deleted on sys-whonix restart.
I’m not sure what was that and can only guess that maybe the sys-whonix is your updatevm and when you’ve updated your Qubes OS templates/dom0 the packages were downloaded and temporally stored in sys-whonix and almost took all the free space in sys-whonix.
Interesting. I don’t remember setting whonix updates to come in over Tor.
I did an ls -l on directory this while just before your reply came in.
cached-microdescs is huge.
I found a couple of discussions online that talk about it being a cache of connection information, to help in each future connection that Tor will make (or each instance of sys-whonix in Qubes’ case I guess).
This 2017 comment explicitly says that they stuff several MB in there because memory is cheap these days.
But, I really am at/past the edge of my understanding here.