We have a legacy centos 5.11 server; filesystems are ext3, we cannot change.
Is it possible to have realtime compression on a single file (a giant log file) ?
zram : I cannot find it in the repos...
Is it possible using cloop ?
Apparently cloop devices are read-only and would require building a custom kernel module anyway.
zram is only available in standard kernels starting from version 3.14, so Centos 5.x's standard kernel version 2.6.18 is way too old for it.
This sounds very much like a XY problem: you should probably identify the program that produces your huge log file, and ask for ways to deal with it.
A more common solution for giant log files is log file rotation: the existing contents of the log file are copied elsewhere, and the active log file is truncated immediately after the copying is completed. If the program producing the log does a
fseek(file, 0L, SEEK_END) or equivalent before writing each new log entry, the log can be truncated without problems.
But if the program remembers the last writing position in the log file and assumes the file is unchanged since its previous write operation, and explicitly seeks to that position, you'll get an instant demonstration of a sparse file in any POSIX-compliant filesystem: the cut-off portion reappears, filled with zero bytes... but those bytes occupy no actual disk space!
Generally, many applications designed for long-term operation either allow the on-the-fly truncation of their log files, or have a built-in mechanism for log file rotation. For example, some applications will close and re-open their log files when they receive a specific signal.
CentOS 5.x even has a
logrotate tool as a part of its standard configuration: just drop in a configuration file identifying the log file(s) to be rotated and the desired rotation schedule (daily, weekly etc.) in
/etc/logrotate.d and it will do the job.