From owner-freebsd-questions@FreeBSD.ORG Wed Oct 18 12:57:56 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 334ED16A403 for ; Wed, 18 Oct 2006 12:57:56 +0000 (UTC) (envelope-from keramida@ceid.upatras.gr) Received: from igloo.linux.gr (igloo.linux.gr [62.1.205.36]) by mx1.FreeBSD.org (Postfix) with ESMTP id 69DA543D78 for ; Wed, 18 Oct 2006 12:57:49 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from gothmog.pc (host5.bedc.ondsl.gr [62.103.39.229]) (authenticated bits=128) by igloo.linux.gr (8.13.8/8.13.8/Debian-2) with ESMTP id k9ICvNbf012133 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 18 Oct 2006 15:57:26 +0300 Received: from gothmog.pc (gothmog [127.0.0.1]) by gothmog.pc (8.13.8/8.13.8) with ESMTP id k9ICvvt8024987; Wed, 18 Oct 2006 15:57:59 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Received: (from giorgos@localhost) by gothmog.pc (8.13.8/8.13.8/Submit) id k9ICvt12024986; Wed, 18 Oct 2006 15:57:55 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Date: Wed, 18 Oct 2006 15:57:55 +0300 From: Giorgos Keramidas To: Paul Murphy Message-ID: <20061018125755.GB15285@gothmog.pc> References: <45357AF8.1020101@rithy4u.net> <20061018014819.GA72686@gothmog.pc> <45360C5F.4090400@cogeco.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <45360C5F.4090400@cogeco.ca> X-Hellug-MailScanner: Found to be clean X-Hellug-MailScanner-SpamCheck: not spam, SpamAssassin (score=-1.584, required 5, AWL -1.18, BAYES_00 -2.60, DNS_FROM_RFC_ABUSE 0.20, DOMAIN_4U2 1.99, UNPARSEABLE_RELAY 0.00) X-Hellug-MailScanner-From: keramida@ceid.upatras.gr X-Spam-Status: No Cc: freebsd-questions@freebsd.org, root@rithy4u.net Subject: Re: File system full X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Oct 2006 12:57:56 -0000 On 2006-10-18 07:13, Paul Murphy wrote: >Giorgos Keramidas wrote: >>On 2006-10-18 07:53, "Office of CEO- rithy4u.NET" wrote: >>> Dear All, >>> My firewall server was running out of space on / partition I >>> have try to reboot/fsck and delete all unneccessary files >>> inside / but I still get 12 MB of free space with total 495 MB >>> worth of that partition. Any ideas? >> >> First of all, try to track down where all the space has gone, by >> using `df' and `du' with the -x option. For example, you can get >> a good idea of which places in your root filesystem are the top-10 >> users of space with: >> >> # cd / >> # du -xm . | sort -nr | head -10 >> >> If this doesn't show up a lot of stuff, then there's probably a >> rogue process which has opened a file and then removed it, so >> it's not directly visible by traversing the tree with `du', but >> you can still look for it with: >> >> # fstat -f / | sort -k +8 >> >> After you get this sort of information, we can make more informed >> suggestions about the best way to move forward :) > > I have been trying to track down a similar problem! Using the above > method I think I have found 'natd' to be the culprit. Should 'natd' > receive a signal when 'alias.log' rolls over? Restarting 'natd' seems > to have releases some megabytes. Nice catch, Paul! The `alias.log' file is supposed to be in `/var/log', but I guess if you use a single root filesystem for everything, this can end up filling the root filesystem. The file `alias.log' is not rotated by `newsyslog.conf', so maybe we should add it there? Then we can let `newsyslog' signal `natd' by: %%% diff -r 4474abb9619a etc/newsyslog.conf --- a/etc/newsyslog.conf Fri Oct 13 17:34:54 2006 +0300 +++ b/etc/newsyslog.conf Wed Oct 18 15:54:52 2006 +0300 @@ -18,6 +18,7 @@ # # logfilename [owner:group] mode count size when flags [/pid_file] [sig_num] /var/log/all.log 600 7 * @T00 J +/var/log/alias.log 600 7 100 * JC /var/run/natd.pid /var/log/amd.log 644 7 100 * J /var/log/auth.log 600 7 100 * JC /var/log/console.log 600 5 100 * J %%% Can you please add this line to your newsyslog.conf file and let it run for a while to see if it prevents the `alias.log' file of `natd' to fill your /var/log filesystem? I don't use `natd', so I can't test this myself for a long enough period. Regards, Giorgos