My users home directory is ephemeral as well, so this wouldn’t happen. Everything I didn’t declare to persist is deleted on reboot.

What I do use tools like these for is verifying that my persistent storage paths are properly bind mounted and files end up in the correct filesystem.

I use dust for this, specifically with the -x flag to not traverse multiple filesystems.

selber hs °^°

My / is a tmpfs.

There is no state accumulating that I didn’t explicitly specify, exactly because I don’t want to deal with those kind of chores.

I don’t think they meant forcing themselves because their RAM would fill up, but because their stuff would be gone after rebooting if they didn’t move it.

They don’t support DNSSEC.

I meant like in general…

I do agree it’s worth investigating if it happens again. My best guess so far would be some kind of data written to a tmpfs. That’d explain it not being associated with a particular process, yet counting towards actual used RAM.

Why do you care so much about memory usage?

Unused RAM is wasted RAM.

You can use journalctl -b <index>, where 0 is the current boot session, -1 the previous boot session and so on.

You can see all sessions with journalctl --list-boots if you want to pick a specific one.

Spacebar looks promising IMO.