The order I see is: rename() currentsyslog archivesyslog openat() currentsyslog fsync() currentsyslog fsync() dir of currentsyslog fallocate() currentsyslog repeats for the user log Where I get lost is at 10:04:18 ioctl(103, FS_IOC_SETFLAGS, 0x7ffc6429954c) = 0 > /usr/lib64/libc-2.29.9000.so(ioctl+0xb) [0xf736b] > /usr/lib/systemd/libsystemd-shared-242.so(chattr_fd+0xe0) [0x11da20] I don't know if that's doing 'chattr -C' on the renamed, now archived, log. But right after that is 10:04:18 ioctl(103, BTRFS_IOC_DEFRAG) = 0 > /usr/lib64/libc-2.29.9000.so(ioctl+0xb) [0xf736b] > /usr/lib/systemd/libsystemd-shared-242.so(btrfs_defrag_fd+0x23) [0x130803] So even if -C can't really succeed on a non-empty file, maybe it somehow allows defrag to compress on a filesystem that's mounted with compress option? Chris Murphy
