From owner-freebsd-questions@FreeBSD.ORG  Thu Sep  9 17:09:11 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1E54616A4CE
	for <questions@freebsd.org>; Thu,  9 Sep 2004 17:09:11 +0000 (GMT)
Received: from destiny.chrononomicon.com (mail.chrononomicon.com
	[65.193.73.208])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C5FBB43D54
	for <questions@freebsd.org>; Thu,  9 Sep 2004 17:09:10 +0000 (GMT)
	(envelope-from bsilver@chrononomicon.com)
Received: from [127.0.0.1] (destiny.chrononomicon.com [192.168.1.42])
	by destiny.chrononomicon.com (Postfix) with ESMTP id 1C8451FE26
	for <questions@freebsd.org>; Thu,  9 Sep 2004 13:08:57 -0400 (EDT)
Mime-Version: 1.0 (Apple Message framework v619)
In-Reply-To: <20040909130333.67242dc4.wmoran@potentialtech.com>
References: <44A044721750C2FA9877513F@utd49554.utdallas.edu>
	<20040909130333.67242dc4.wmoran@potentialtech.com>
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <EEB300B1-0282-11D9-A45D-000D9338770A@chrononomicon.com>
Content-Transfer-Encoding: 7bit
From: Bart Silverstrim <bsilver@chrononomicon.com>
Date: Thu, 9 Sep 2004 13:08:55 -0400
To: questions@freebsd.org
X-Mailer: Apple Mail (2.619)
Subject: Re: Phantom /var full messages
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Sep 2004 17:09:11 -0000


On Sep 9, 2004, at 1:03 PM, Bill Moran wrote:

> Paul Schmehl <pauls@utdallas.edu> wrote:
<snip>
>
>> I suspect this is some sort of filehandle not being released issue, 
>> but I'm
>> not sure how to track it down.  I've got lsof installed, but I'm not 
>> an
>> expert on it yet.
>>
>> Any hints would be welcomed.  What's the best way to troubleshoot this
>> problem?
>
> First, if you could isolate it to just snort or just MySQL.

Use "lsof" and grep to figure out what file handles are still open by 
mysqld and/or snort.  Might narrow it down for you.

-Bart