From owner-freebsd-questions@FreeBSD.ORG Wed Oct 18 13:35:46 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C490316A416 for ; Wed, 18 Oct 2006 13:35:46 +0000 (UTC) (envelope-from m.seaman@infracaninophile.co.uk) Received: from smtp.infracaninophile.co.uk (ns0.infracaninophile.co.uk [81.187.76.162]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2EA4143D5E for ; Wed, 18 Oct 2006 13:35:32 +0000 (GMT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from [172.16.3.238] (gateway.ash.thebunker.net [213.129.64.4]) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.13.8/8.13.8) with ESMTP id k9IDYPM1065727 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 18 Oct 2006 14:34:46 +0100 (BST) (envelope-from m.seaman@infracaninophile.co.uk) Authentication-Results: smtp.infracaninophile.co.uk from=m.seaman@infracaninophile.co.uk; sender-id=softfail; spf=softfail X-SenderID: Sendmail Sender-ID Filter v0.2.14 smtp.infracaninophile.co.uk k9IDYPM1065727 Message-ID: <45362D5B.3060401@infracaninophile.co.uk> Date: Wed, 18 Oct 2006 14:34:19 +0100 From: Matthew Seaman Organization: Infracaninophile User-Agent: Thunderbird 1.5.0.7 (X11/20060919) MIME-Version: 1.0 To: Giorgos Keramidas References: <45357AF8.1020101@rithy4u.net> <20061018014819.GA72686@gothmog.pc> <45360C5F.4090400@cogeco.ca> <20061018125755.GB15285@gothmog.pc> In-Reply-To: <20061018125755.GB15285@gothmog.pc> X-Enigmail-Version: 0.94.0.0 Content-Type: multipart/signed; micalg=pgp-ripemd160; protocol="application/pgp-signature"; boundary="------------enig7A9B6FA425AFFC64173F2816" X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-2.0.2 (smtp.infracaninophile.co.uk [81.187.76.162]); Wed, 18 Oct 2006 14:35:07 +0100 (BST) X-Virus-Scanned: ClamAV 0.88.5/2041/Wed Oct 18 07:29:52 2006 on happy-idiot-talk.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-0.9 required=5.0 tests=AWL,BAYES_00, DKIM_POLICY_TESTING, DOMAIN_4U2, SPF_SOFTFAIL autolearn=no version=3.1.6 X-Spam-Checker-Version: SpamAssassin 3.1.6 (2006-10-03) on happy-idiot-talk.infracaninophile.co.uk Cc: Paul Murphy , freebsd-questions@freebsd.org, root@rithy4u.net Subject: Re: File system full X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Oct 2006 13:35:46 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig7A9B6FA425AFFC64173F2816 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable Giorgos Keramidas wrote: > On 2006-10-18 07:13, Paul Murphy wrote: >> Giorgos Keramidas wrote: >>> On 2006-10-18 07:53, "Office of CEO- rithy4u.NET" = wrote: >>>> Dear All, >>>> My firewall server was running out of space on / partition I >>>> have try to reboot/fsck and delete all unneccessary files >>>> inside / but I still get 12 MB of free space with total 495 MB >>>> worth of that partition. Any ideas? >>> First of all, try to track down where all the space has gone, by >>> using `df' and `du' with the -x option. For example, you can get >>> a good idea of which places in your root filesystem are the top-10 >>> users of space with: >>> >>> # cd / >>> # du -xm . | sort -nr | head -10 >>> >>> If this doesn't show up a lot of stuff, then there's probably a >>> rogue process which has opened a file and then removed it, so >>> it's not directly visible by traversing the tree with `du', but >>> you can still look for it with: >>> >>> # fstat -f / | sort -k +8 >>> >>> After you get this sort of information, we can make more informed >>> suggestions about the best way to move forward :) >> I have been trying to track down a similar problem! Using the above >> method I think I have found 'natd' to be the culprit. Should 'natd' >> receive a signal when 'alias.log' rolls over? Restarting 'natd' seems >> to have releases some megabytes. >=20 > Nice catch, Paul! >=20 > The `alias.log' file is supposed to be in `/var/log', but I guess if yo= u > use a single root filesystem for everything, this can end up filling th= e > root filesystem. >=20 > The file `alias.log' is not rotated by `newsyslog.conf', so maybe we > should add it there? Then we can let `newsyslog' signal `natd' by: >=20 > %%% > diff -r 4474abb9619a etc/newsyslog.conf > --- a/etc/newsyslog.conf Fri Oct 13 17:34:54 2006 +0300 > +++ b/etc/newsyslog.conf Wed Oct 18 15:54:52 2006 +0300 > @@ -18,6 +18,7 @@ > # > # logfilename [owner:group] mode count size when flags [/= pid_file] [sig_num] > /var/log/all.log 600 7 * @T00 J > +/var/log/alias.log 600 7 100 * JC /var/run/natd.pid > /var/log/amd.log 644 7 100 * J > /var/log/auth.log 600 7 100 * JC > /var/log/console.log 600 5 100 * J > %%% >=20 > Can you please add this line to your newsyslog.conf file and let it run= > for a while to see if it prevents the `alias.log' file of `natd' to fil= l > your /var/log filesystem? >=20 > I don't use `natd', so I can't test this myself for a long enough > period. natd doesn't do the close and re-open all filehandles thing on receipt of SIGHUP which pretty much makes it unsuitable for use with newsyslog. (SIGHUP is caught by natd, but the only thing it does is cause natd to update its idea of what the IP address is on the nat'ed interface.) There doesn't seem to be any signal that you can send natd with the usual 'reread all config files and re-open all file descriptors' effect that most daemons understand. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. Flat 3 7 Priory Courtyard PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW, UK --------------enig7A9B6FA425AFFC64173F2816 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (FreeBSD) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFNi1g8Mjk52CukIwRAw6xAJ42LB/OUqvx77VU8dCdYjvWJVcedACdHuNB lHWtuls5XNSljbqP96sCxRg= =q/HA -----END PGP SIGNATURE----- --------------enig7A9B6FA425AFFC64173F2816--