Home / Checking what it gives back

What a check exempts disappears from its output

An exemption placed in a check for a good reason removes the exempted part from what the check judges: until that part has its own measure and its own limit, it can grow under a compliant verdict.

Take a typical case. A nightly check compares the disk usage of a project folder to a limit. Its rule exempts the cache/ subfolder, for a reason that held when it was created: its contents regenerate and can be emptied at any time, so it did not deserve an alert. Months later, the disk fills up while the check shows compliant every night.

A scope chosen, then forgotten

The lesson on where you look showed that a verification first finds what it looks at. Here a specific trait is added: the scope was decided once, written into the rule, then nobody rereads it, because the check's output does not mention it. A compliant verdict reads as a verdict on the folder, when it covers the folder minus its cache.

The following demonstration creates its own folder, writes the check, fills the exempted part, then measures the whole folder:

mkdir -p demo-exemption/project/cache demo-exemption/project/docs && cd demo-exemption
printf 'report one\n' > project/docs/report1.txt
printf 'report two\n' > project/docs/report2.txt
cat > check.sh << 'EOF'
#!/bin/sh
# Disk usage of project/, cache/ is exempted by the rule
LIMIT=5000
SIZE=$(find project -path project/cache -prune -o -type f -exec cat {} + | wc -c | tr -d ' ')
echo "Counted usage: $SIZE bytes (limit $LIMIT)"
if [ "$SIZE" -le "$LIMIT" ]; then echo "Verdict: compliant"; else echo "Verdict: over limit"; fi
EOF
sh check.sh
dd if=/dev/zero of=project/cache/index.bin bs=1024 count=50 2>/dev/null
sh check.sh
echo "Actual usage of project/: $(find project -type f -exec cat {} + | wc -c | tr -d ' ') bytes"

Counted usage: 22 bytes (limit 5000)
Verdict: compliant
Counted usage: 22 bytes (limit 5000)
Verdict: compliant
Actual usage of project/: 51222 bytes

The check walks project/ and all its subfolders, and it sets aside project/cache with the -prune option of find. Its verdict does not move when the cache receives a large file, while the measure of the whole folder, taken outside the check, shows that the cache carries most of the usage. 2>/dev/null hides the summary printed by dd. The sum by wc -c measures the contents of the files, not the blocks reserved on disk, which is enough for a gap of this size.

Giving the exempted part a limit

Removing the exemption would bring back the alerts the rule meant to avoid, since the cache always regenerates. But what justified it, negligible contents, no longer holds when the cache carries most of the usage. Displaying its size is not enough: a line under a verdict that stays compliant gets read as little as the rule does. The remedy keeps the cache out of the main limit and gives it its own limit, which weighs on the verdict. It also checks that the exempted folder exists, failing which find would find nothing and the check would show zero bytes. From the same folder:

cat > check.sh << 'EOF'
#!/bin/sh
# Disk usage of project/: cache/ leaves the main limit and gets its own limit
LIMIT=5000
CACHE_LIMIT=20000
SIZE=$(find project -path project/cache -prune -o -type f -exec cat {} + | wc -c | tr -d ' ')
echo "Counted usage: $SIZE bytes (limit $LIMIT)"
VERDICT=compliant
if [ "$SIZE" -gt "$LIMIT" ]; then VERDICT="over limit"; fi
if [ -d project/cache ]; then
  EXEMPT=$(find project/cache -type f -exec cat {} + | wc -c | tr -d ' ')
  echo "Exempted part: cache/ $EXEMPT bytes (own limit $CACHE_LIMIT)"
  if [ "$EXEMPT" -gt "$CACHE_LIMIT" ]; then VERDICT="exempted part over limit"; fi
else
  echo "Exempted part: cache/ not found, not measured"
  if [ "$VERDICT" = compliant ]; then VERDICT="to check"; fi
fi
echo "Verdict: $VERDICT"
EOF
sh check.sh

Counted usage: 22 bytes (limit 5000)
Exempted part: cache/ 51200 bytes (own limit 20000)
Verdict: exempted part over limit

The check now returns an overrun where it used to say compliant, and it names the part responsible. If cache/ disappears, it says so and returns "to check" rather than a reassuring zero.