(Solved) using blesh floods and disables terminal

[vagrant solar]

Recently my terminal started upon being opened getting flooded with this messages
bash: /run/user/1000/blesh/1293254.util.assign.tmp.0: No space left on device
bash: /run/user/1000/blesh/1293254.edit-history-load: No such file or directory
bash: /run/user/1000/blesh/1293254.edit-history-load-multiline-index: No such file or directory

and removing the following from .bashrc seems to fix it

[[ $- == *i* ]] && source /usr/share/blesh/ble.sh

But that also means all the colors and autocomplete options get removed. I still have plenty of space, so I don't know why this is happening.

[lyric heron]

What is the output from

 df  /run

[vagrant solar]

Filesystem     1K-blocks  Used Available Use% Mounted on
tmpfs            6557480  9556   6547924   1% /run

[lyric heron]

df /run/user/1000

[vagrant solar]

Filesystem     1K-blocks    Used Available Use% Mounted on
tmpfs            3278736 1512248   1766488  47% /run/user/1000

[lyric heron]

This path should be small during normal operation.

Can you run

sudo pacman -S dust
sudo dust /run/user/1000

[lyric heron]

ls -1 /run/user/1000 | wc -l

[vagrant solar]

819604

[lyric heron]

Are these all something like sdl-shared?

ls -1 /run/user/1000/sdl-shared* | wc -l

[vagrant solar]

No idea.

moonburst@archlinux:~$ ls -1 /run/user/1000/sdl-shared* | wc -l
bash: /usr/bin/ls: Argument list too long
0

[lyric heron]

I think they are

 find /run/user/1000 -name "*sdl-shared*" | wc -l

[vagrant solar]

find: ‘/run/user/1000/systemd/inaccessible/dir’: Permission denied
819579

[lyric heron]

https://github.com/libsdl-org/SDL/blob/8adab0b88ab1c0aa69242fffc48afdba085b1dc4/src/video/wayland/SDL_waylandmouse.c#L377

[vagrant solar]

You think this is a thing about hyprland changing the way the mouse works? It almost looks like it's related.

[lyric heron]

Its SDL's doing

hyprland does not use SDL

[vagrant solar]

So is this a 'wait for an upstream update' thing? admittedly I don't understand the github code there

[lyric heron]

You can use audit to find the culprit.

sudo auditctl -w /run/user/1000

And post the journal log

journalctl -S -10min | gzip > logs.gz

[vagrant solar]

rebooting seemed to fix it for the time. But I do have this still

[lyric heron]

systemd-journald[177]: Collecting audit messages is disabled.
If you disable the collection of audit messages, this won't work

cat /proc/cmdline

[vagrant solar]

▽moonburst@archlinux:~$ cat /proc/cmdline
initrd=\amd-ucode.img initrd=\initramfs-linux.img root=PARTUUID=4d76ca7f-5b26-4ed6-8564-42d1b64ce727 zswap.enabled=0 rw rootfstype=ext4 nvidia_drm.modeset=1

[lyric heron]

dmesg should contain the audit log, please post your dmesg

dmesg | gzip > dmesg.gz

[lyric heron]

Have you disabled the audit framework because I don't see any audit logs anywhere.

[vagrant solar]

Not as far as I know. I haven't taken steps to disable pretty much anything

[lyric heron]

If it is not disabled, there should be something like

 audit: type=2000 audit(1690167894.779:1): state=initialized audit_enabled=0 res=1

in the dmesg

And by default, Arch collects audit logs in journal

[lyric heron]

Anyway, I suppose a reboot should fix it temporarily. If the problems persist, please enable the audit framework and watch auditctl -w /run/user/1000.

[vagrant solar]

Needs root permissions, adding sudo and

[ble: expand] sudo auditctl -w /run/user/1000
[sudo] password for moonburst: 
Error sending add rule data request (Rule exists)

[lyric heron]

||As an old samurai once said, "No one ever reads error messages".||

||You have already added the rule||

[vagrant solar]

So it seems

[lyric heron]

See this page on how to enable audit https://wiki.archlinux.org/title/Audit_framework

The rules will be deleted on restart.

[lyric heron]

This rule will cause audit to record any syscall made by any process with the path /run/user/1000. You can grep for name="/run/user/1000/sdl-shared" and look at the exe= field to find the suspect.

[vagrant solar]

Well, I've got the service enabled, assuming I understood the wiki.

[lyric heron]

Also make sure that systemd-journald-audit.socket isn't masked.

[lyric heron]

If you mean auditd, it will store the logs in /var/log/audit/audit.log.

[vagrant solar]

Yeah, I got the audit. but nothing from the sdl anything.

I ran cat on it, and nothing about that.

[lyric heron]

It's probably a one-off bug, add this rule and grep the audit log next time you encounter the problem.

[vagrant solar]

I'll try that. Thank you. For now would it be better to mark this as solved?

[lyric heron]

Just as you like it