Date: Sun, 9 Jun 2002 12:55:02 -0700 (PDT) From: Mikko Tyolajarvi <mikko@dynas.se> To: sroberts@dsl.pipex.com Cc: questions@freebsd.org Subject: Re: Strange size increase in /var Message-ID: <200206091955.g59Jt2kj010659@mikko.na.rsa.net> References: <1023648827.318.73.camel@Demon.Strobe.org>
next in thread | previous in thread | raw e-mail | index | archive | help
In local.freebsd.questions you write: >Hello, > Over the last two days, I've noticed a significant increase in the >size of /var on this system: ># df -k >Filesystem 1K-blocks Used Avail Capacity Mounted on >/dev/ad0s1a 148823 42962 93956 31% / >/dev/ad0s1f 11789353 1527589 9318616 14% /usr >/dev/ad0s1e 297663 51443 222407 19% /var >procfs 4 4 0 100% /proc ># >Normally /var would come in at around 13% - 14%, as was the case this >time last week, I believe. >Here's what du returns: ># pwd >/var ># du -h -d0 > 50M . ># du -h -d1 >1.0K ./account >3.0K ./at > 11K ./backups >2.0K ./crash >3.0K ./cron > 24M ./db I'd check this: du -k /var/db Unless you have any applications storing data here, most of the space is usually consumed by /var/db/pkg (depending on how many ports or packages you have installed). >1.0K ./heimdal > 14M ./log >1.0K ./mail >2.0K ./msgs >1.0K ./preserve > 56K ./run >1.0K ./rwho > 11M ./spool Most likely culprit. du -k /var/spool. Something may have been been queued up (mail, printjobs). If there are users on this machine, someone may have put something in /var/spool/uucppublic (publicly writable, you might as well delete it unless you are actually using uucp). On a virgin system /var/spool is less than 100K. >2.0K ./tmp > 20K ./yp > 62K ./games >2.0K ./lib > 50M . I suppose a stray core file is a possibility too. $.02, /Mikko -- Mikko Tyolajarvi_______________________________________mikko@rsasecurity.com RSA Security To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200206091955.g59Jt2kj010659>