From owner-freebsd-questions@FreeBSD.ORG  Fri Jun  3 00:09:20 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4A1F016A41C
	for <freebsd-questions@freebsd.org>;
	Fri,  3 Jun 2005 00:09:20 +0000 (GMT)
	(envelope-from james@idea-anvil.net)
Received: from jail.idea-anvil.net (idea-anvil.net [63.226.12.96])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D6F4A43D48
	for <freebsd-questions@freebsd.org>;
	Fri,  3 Jun 2005 00:09:19 +0000 (GMT)
	(envelope-from james@idea-anvil.net)
Received: from idea-anvil.net (vaio [10.0.0.99])
	by jail.idea-anvil.net (8.12.11/8.12.9) with ESMTP id j5309JNO049755
	for <freebsd-questions@freebsd.org>;
	Thu, 2 Jun 2005 17:09:19 -0700 (MST)
	(envelope-from james@idea-anvil.net)
From: James <james@idea-anvil.net>
To: freebsd-questions@freebsd.org
Date: Thu, 2 Jun 2005 17:08:55 -0700
User-Agent: KMail/1.8
References: <200506020447.35717.james@idea-anvil.net>
	<429F15F8.9020704@dial.pipex.com>
In-Reply-To: <429F15F8.9020704@dial.pipex.com>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200506021708.55859.james@idea-anvil.net>
Subject: Re: ppp filling /var
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 03 Jun 2005 00:09:20 -0000

On Thursday 02 June 2005 07:21 am, Alex Zbyslaw wrote:
> James wrote:
> >After ppp runs for a few days:
> >
> ># df
> >Filesystem    Size   Used  Avail Capacity  Mounted on
> >/dev/ad0s1a   126M    49M    67M    42%    /
> >/dev/ad0s1f   252M    18K   232M     0%    /tmp
> >/dev/ad0s1g   8.1G   1.1G   6.4G    15%    /usr
> >/dev/ad0s1e   252M   252M -20.0M   109%    /var <----!!!
> >procfs        4.0K   4.0K     0B   100%    /proc
> >
> ># du -h /var
> >... snip ...
> >12M    /var
>
> If a file is opened, deleted and then written to, it will keep taking space
> without showing up under du.  Does fstat show anything useful when ppp is
> running?
>
> Could you use pppd instead?

# fstat -f /var
USER     CMD          PID   FD MOUNT      INUM MODE         SZ|DV R/W
aksis    fstat      72843   wd /var      16259 drwxr-xr-x    1536  r
root     natd       72299    4 /var      16266 -rw-------  31316863  w
aksis    bash       68199   wd /var      16259 drwxr-xr-x    1536  r
smmsp    sendmail     318   wd /var         34 drwxrwx---     512  r
smmsp    sendmail     318    4 /var        244 -rw-------      49  w
root     sendmail     315   wd /var         23 drwxr-xr-x     512  r
root     sendmail     315    7 /var         96 -rw-------      43  w
root     cron         217   wd /var          9 drwxr-x---     512  r
root     cron         217    3 /var        304 -rw-r--r--       4 rw
root     syslogd      209    7 /var      16290 -rw-------  100708  w
root     syslogd      209    8 /var      16285 -rw-------   86683  w
root     syslogd      209    9 /var      16279 -rw-------   12534  w
root     syslogd      209   10 /var      16325 -rw-------    1892  w
root     syslogd      209   11 /var      16281 -rw-r--r--       0  w
root     syslogd      209   12 /var      16301 -rw-------   11407  w
root     syslogd      209   13 /var      16317 -rw-------   83869  w
root     syslogd      209   15 /var      16286 -rw-r-----       0  w
root     syslogd      209   16 /var      16263 -rw-------   26137  w

So it looks like it is natd and not ppp. 
lsof isn't showing what file natd has open and is writing to.

At this time, I don't know how to configure pppd, so I can't use it yet. :-(

What does natd do that !!! :-\ is that a bug?