From owner-freebsd-questions Wed Nov 13 6:55:35 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EDDBB37B401 for ; Wed, 13 Nov 2002 06:55:33 -0800 (PST) Received: from clunix.cl.msu.edu (clunix.cl.msu.edu [35.9.2.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 501E243E8A for ; Wed, 13 Nov 2002 06:55:33 -0800 (PST) (envelope-from jerrymc@clunix.cl.msu.edu) Received: (from jerrymc@localhost) by clunix.cl.msu.edu (8.11.6+Sun/8.11.6) id gADEtVn12882; Wed, 13 Nov 2002 09:55:31 -0500 (EST) From: Jerry McAllister Message-Id: <200211131455.gADEtVn12882@clunix.cl.msu.edu> Subject: Re: I'm probably overlooking something really stupid but... To: warendaj@comcast.net (J.M. Warenda) Date: Wed, 13 Nov 2002 09:55:31 -0500 (EST) Cc: freebsd-questions@FreeBSD.ORG In-Reply-To: <008c01c28af0$fe072360$4500a8c0@lucifer> from "J.M. Warenda" at Nov 13, 2002 03:45:17 AM X-Mailer: ELM [version 2.5 PL2] MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG > > ...sometimes you need to just ask to see if you overlooked > something obvious. > > I'm running a FreeBSD 4.4-RELEASE box as my natd gateway for my > home LAN and lately it's been reporting that /var is full ... df > reports it at 107% capacity but du doesn't reveal what's filling it up. > > I had once had apache fill /var because of some trojan trying IIS > attacks on my apache server, but I've since disabled Apache so, it's > not that! Only other things running are ftpd, telnetd, and sshd ... > plus ezbounce (so I can ident on EFNet from machines behind the > gateway), natd, and xchat under X. > > Any thoughts on what might be filling var? I ran fsck -f and that > didn't reveal anything. Did you look and see which files are getting so big in /var ? - eg cd to /var and do 'du -sk *' and go down a directory or so if needed, such as if it is in /var/log find out which file in /log is so big and then look in it and see what the log messages are. Or if it is in spool, see which file is big and it will give you an idea of what is getting stuck. that would get you started for places to look anyway. ////jerry > > -John > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message