How to find which files are in RAM overlay?

[Athwale]

Hi,

I have been experimenting with a live fedora 37 image.
Based on this https://github.com/dracutdevs/dracut/blob/master/man/dracut.cmdline.7.asc#booting-live-images
I am using the rd.live.overlay.thin=1 But my RAM usage is still going up over the course of several days despite disabling logging and various other things that typically consume disk space.

Is there a way to see which files are copied in the overlay in RAM?

Thanks.

[LaszloGombos]

@Athwale

mount | grep LiveOS_rootfs

Look for upperdir. Most likely /run/overlayfs

[Athwale]

@LaszloGombos Thanks

That does not appear to be there. There is also no /run/overlayfs

I did not set the rd.live.overlay.overlayfs=1 though the rd.live.overlay.thin=1 clearly is doing something.
So it is using squashfs snapshot overlay.
Any way to get the information from there?
Also am I supposed to use the thin overlay with the snapshot overlays or just with the overlayFS?
Thanks.

$ mount
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime,seclabel)
devtmpfs on /dev type devtmpfs (rw,nosuid,seclabel,size=4096k,nr_inodes=1048576,mode=755,inode64)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,seclabel,size=307200k,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,seclabel,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,size=801748k,nr_inodes=819200,mode=755,inode64)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,seclabel,nsdelegate,memory_recursiveprot)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime,seclabel)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
/dev/sr0 on /run/initramfs/live type iso9660 (ro,relatime,nojoliet,check=s,map=n,blocksize=2048,iocharset=utf8)
/dev/mapper/live-rw on / type ext4 (rw,relatime,seclabel)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,nosuid,noexec,relatime)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=34,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=18605)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime,seclabel)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,seclabel,pagesize=2M)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime,seclabel)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime,seclabel)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime,seclabel,inode64)
vartmp on /var/tmp type tmpfs (rw,nosuid,nodev,noexec,relatime,seclabel,inode64)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,seclabel,size=400872k,nr_inodes=100218,mode=700,uid=1000,gid=1000,inode64)
portal on /run/user/1000/doc type fuse.portal (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)

[LaszloGombos]

CC @iammattcoleman @Conan-Kudo

[Athwale]

Also it is fedora 37 and this is the boot command line:
linuxefi /images/pxeboot/vmlinuz root=live:CDLABEL=Fedora-37 rd.live.image ipv6.disable=1 rd.live.overlay.thin=1 initrdefi /images/pxeboot/initrd.img

Switching thin between 1/0 does clearly have some effect on the system.
With 0 the ram usage goes up when files are added and does not go down as expected according to documentation.
With 1 the ram appears to be returned to the system when files are deleted, though it still slowly creeps up over time.
So I suspect there is something somewhere adding files or writing into a file.