TrixBox Cache increases dramatically overnight

Hi, I am new to this forum and know very little about TrixBox and Asterisk, just appointed as new ops manager and I need to resolve a problem.
In the morning I reboot the TrixBox system to clear the cache.
Now after all day in the office the cache is 16%.
Tomorrow morning at 9 am it will be at 90%
Can anybody help?

“cache” doesn’t make much sense in an Asterisk context, so I assume it is a TrixBox term.

TrixBox appears to be a completely dead product, as of the beginning of the year. There is no commercial support and the peer support forum appears to have been made read-only.

A wild guess is that toll fraud attacks peak overnight, but not knowing the purpose of the “cache”, that is just a guess. suggests this may actually be the Linux disk cache, but, normally, a large disk cache is not a problem. Linux (and Windows NT family for that matter), try to maximise the use of memory, by using otherwise free memory for cache and buffer space. Overnight you may not be using much buffer space, so it is possible that the balance shifts to cache usage, but that would normally change back as you start doing I/O.

I haven’t read the Google hits, which may indicate something funny about TrixBox and a large cache usage.

I had a look at one of the Google hits. Although maximising physical memory use is normal, if you are actually out of swap as well, another possibility arises.

If TrixBox uses Linux tmpfs, for some of the files, because that is handled like cached disk, but has no disk to back up the cache, it might be accounted for out of the cache figure, but have no mechanism for purging the cache other than to the finite swap space. (Normal disk cache always has space reserved on disk, to which it can be written out.)

I seem to remember that TrixBox is for use on flash memory based systems, and such devices have limited numbers of write operations before they wear out. If so, the use of tmpfs is particularly likely. (But using any swap space is a bad thing.)

If tmpfs is overflowing and you are Linux literate, you need to find out which directories use it and look for files there. They might be log files or voicemail files. Look to see if any type are consuming a lot of space, and if log files, look at what is being logged.

If you are not Linux literate, find your local Linux gura.

Because it can overflow to swap, it is possible that quite a small increase can take you from having filled swap to monoplising RAM, if your RAM is small but your swap is large. Before swap oveflows, the proportion of RAM used for cache may well be fairly constant. If you are on flash memory, you really want enough RAM not to make much use of swap.

It is still possible that attacks on the system are consuming space mainly at night.