From owner-freebsd-questions@FreeBSD.ORG Fri Feb 6 19:36:45 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8CF1C1065767 for ; Fri, 6 Feb 2009 19:36:45 +0000 (UTC) (envelope-from nealhogan@gmail.com) Received: from el-out-1112.google.com (el-out-1112.google.com [209.85.162.177]) by mx1.freebsd.org (Postfix) with ESMTP id 4322B8FC1F for ; Fri, 6 Feb 2009 19:36:44 +0000 (UTC) (envelope-from nealhogan@gmail.com) Received: by el-out-1112.google.com with SMTP id r27so699578ele.13 for ; Fri, 06 Feb 2009 11:36:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=NU49SRawPTiC5Uw08uZ6AYF4X+rTLCoQnFcOhELVar8=; b=wsjEYH42Ss1cKAbBi0PDhZtX/H80qpICwmhefDnuk703O8hkWYoBG5xzzAPzTtGxKc tSdTIMsbrgBmvKZfMTIVgynjgZLLC5Nkehsk4PdwGc8+d3Sy862kxrzpfGs6t3rgrevO NllZovS1J6TZy8MO/b9i6dYqjwLqytJnIB/+4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=RbZCsX+91X6KzZsjSepangE3ifmTcbUE1BZMFpitfNk61Q7yfeDrV7fU7MIhG5TMrd AAhGd3PQPD7hmI0YOolP3cqNp/dmEAR3GMvlGzrCHXobKeqzZzH0+E3cik0zxlMQ8oRF ryoguvKLn93WXWyVIcRrCGAPnxOfKxbCLoOms= MIME-Version: 1.0 Received: by 10.150.57.17 with SMTP id f17mr1907519yba.171.1233949003480; Fri, 06 Feb 2009 11:36:43 -0800 (PST) In-Reply-To: <922bbbdc3563fcba8c8ed34d7fa6bf1f.squirrel@webmail.superhero.nl> References: <20090206190553.GB13084@dan.emsphone.com> <922bbbdc3563fcba8c8ed34d7fa6bf1f.squirrel@webmail.superhero.nl> Date: Fri, 6 Feb 2009 13:36:43 -0600 Message-ID: From: Neal Hogan To: "Gelsema, P (Patrick) - FreeBSD" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: Dan Nelson , freebsd-questions@freebsd.org Subject: Re: /var grows, apache open file, which file? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Feb 2009 19:36:46 -0000 On Fri, Feb 6, 2009 at 1:27 PM, Gelsema, P (Patrick) - FreeBSD < freebsd@superhero.nl> wrote: > On Fri, February 6, 2009 20:05, Dan Nelson wrote: > > In the last episode (Feb 06), Gelsema, P (Patrick) - FreeBSD said: > >> I noticed that my var slice is getting eaten by apache. The amount of > >> free > >> space is getting less and less per day. So I started to investigate. > >> > >> I did the following; > >> > >> # fstat -u www | grep var | more > >> www httpd 97042 9 /var 74653 -rw------- 176907484 w > >> www httpd 97042 12 /var 71575 -rw------- 1345623 w > >> www httpd 97042 13 /var 24693 -rw-r--r-- 0 w > >> www httpd 97042 15 /var 70919 -rw------- 0 w > >> www httpd 97042 16 /var 70919 -rw------- 0 w > >> www httpd 26059 9 /var 74653 -rw------- 176907484 w > >> www httpd 26059 12 /var 71575 -rw------- 1345623 w > >> > >> So I have an Inumber, lets search for that. > >> > >> # find / -inum 74653 > >> /usr/ports/net/pptpclient/files > >> > >> This confuses me! That is on a different slice. > > > > Then that is not the inode you are looking for. Use "find -x /var ..." > to > > doesnt return anything. > > > limit the search to just the /var mountpoint. Your problem is probably > > due > > to a bad logfile rotator that isn't signalling apache to close&reopen the > > logs, so it keeps logging to a file you have deleted. If you're using > > newsyslog, make sure you have listed your apache pidfile on the line > > correspoinding to any apache logs so it knows which process to signal. > > See > > the newsyslog.conf manpage for more details. > > Added /var/run/httpd.pid to newsyslog.conf and restarted apache. > > I am also using cronolog. > > from httpd.conf: > CustomLog "| /usr/local/sbin/cronolog > /var/log/apache2/%Y/%m/%d/access.log" combined > > Thanks Patrick > > > > > -- > > Dan Nelson > > dnelson@allantgroup.com > > > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to " > freebsd-questions-unsubscribe@freebsd.org" > Just a thought . . . perhaps your situation is similar. I had an issue recently, where /var was maxing out quickly, even after empty all of the logs. It ended up that I was logging too much prior to log rotation. I had recently set-up an ftp server and the rsync of the binary I was mirrorring slammed /var. So, I limited what my firewall logged. Instead of *log all* I would just *log*. -- www.nealhogan.net