Date: Wed, 3 Oct 2001 16:09:06 +0100 (BST) From: Jan Grant <Jan.Grant@bristol.ac.uk> To: David Oleszkiewicz <davido@labrador.dhs.org> Cc: freebsd-questions <freebsd-questions@FreeBSD.org> Subject: Re: /var filling up Message-ID: <Pine.GSO.4.31.0110031606050.28256-100000@mail.ilrt.bris.ac.uk> In-Reply-To: <20011002195847.M13152-100000@labrador.dhs.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 2 Oct 2001, David Oleszkiewicz wrote: > so after about a week and a half of firewall messages and normal logging > messages, my /var fills up. i scan through all the logrotated <log>.gz > files for anything interesting and then i remove them. the thing is the > /bin/df output shows that /var is still above 100%. This means i can't > send or receive mail or anything interesting like that. i reboot and then > everything is ok. > > /var is it's own slice with like 20M Try getting "openfiles": http://ioctl.org/unix/scripts/openfiles and running it as follows: # openfiles /var It just ties the output of fstat, find, ps, etc. together to let you see if there's a process that has an open handle on a file that's been deleted. If the problem is firewall logs, you need to be sure that your firewall logging mechanism (whatever that is) closes and reopens its log files (you can put a pointer to a PID file in newsyslog.conf). Otherwise, your runaway daemon keeps /var/log/xxx.log open, newsyslog compresses the contents (to /var/log/xxx.log.whatever.gz) and unlinks the original, which just keeps growing. jan -- jan grant, ILRT, University of Bristol. http://www.ilrt.bris.ac.uk/ Tel +44(0)117 9287088 Fax +44 (0)117 9287112 RFC822 jan.grant@bris.ac.uk Hang on, wasn't he holding a wooden parrot? No! It was a porcelain owl. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.GSO.4.31.0110031606050.28256-100000>