From owner-freebsd-questions Wed Oct 3 8:11:32 2001 Delivered-To: freebsd-questions@freebsd.org Received: from dire.bris.ac.uk (dire.bris.ac.uk [137.222.10.60]) by hub.freebsd.org (Postfix) with ESMTP id 1800037B403 for ; Wed, 3 Oct 2001 08:11:29 -0700 (PDT) Received: from mail.ilrt.bris.ac.uk by dire.bris.ac.uk with SMTP-PRIV with ESMTP; Wed, 3 Oct 2001 16:11:07 +0100 Received: from cmjg (helo=localhost) by mail.ilrt.bris.ac.uk with local-esmtp (Exim 3.16 #1) id 15ondy-0002IB-00; Wed, 03 Oct 2001 16:09:06 +0100 Date: Wed, 3 Oct 2001 16:09:06 +0100 (BST) From: Jan Grant X-X-Sender: To: David Oleszkiewicz Cc: freebsd-questions Subject: Re: /var filling up In-Reply-To: <20011002195847.M13152-100000@labrador.dhs.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Tue, 2 Oct 2001, David Oleszkiewicz wrote: > so after about a week and a half of firewall messages and normal logging > messages, my /var fills up. i scan through all the logrotated .gz > files for anything interesting and then i remove them. the thing is the > /bin/df output shows that /var is still above 100%. This means i can't > send or receive mail or anything interesting like that. i reboot and then > everything is ok. > > /var is it's own slice with like 20M Try getting "openfiles": http://ioctl.org/unix/scripts/openfiles and running it as follows: # openfiles /var It just ties the output of fstat, find, ps, etc. together to let you see if there's a process that has an open handle on a file that's been deleted. If the problem is firewall logs, you need to be sure that your firewall logging mechanism (whatever that is) closes and reopens its log files (you can put a pointer to a PID file in newsyslog.conf). Otherwise, your runaway daemon keeps /var/log/xxx.log open, newsyslog compresses the contents (to /var/log/xxx.log.whatever.gz) and unlinks the original, which just keeps growing. jan -- jan grant, ILRT, University of Bristol. http://www.ilrt.bris.ac.uk/ Tel +44(0)117 9287088 Fax +44 (0)117 9287112 RFC822 jan.grant@bris.ac.uk Hang on, wasn't he holding a wooden parrot? No! It was a porcelain owl. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message