From owner-freebsd-questions@FreeBSD.ORG Fri Sep 10 15:23:18 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 47BE316A4CE for ; Fri, 10 Sep 2004 15:23:18 +0000 (GMT) Received: from clunix.cl.msu.edu (clunix.cl.msu.edu [35.9.2.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id ADE4743D5E for ; Fri, 10 Sep 2004 15:23:17 +0000 (GMT) (envelope-from jerrymc@clunix.cl.msu.edu) Received: (from jerrymc@localhost) by clunix.cl.msu.edu (8.11.7p1+Sun/8.11.7) id i8AFNCr07551; Fri, 10 Sep 2004 11:23:12 -0400 (EDT) From: Jerry McAllister Message-Id: <200409101523.i8AFNCr07551@clunix.cl.msu.edu> To: pauls@utdallas.edu Date: Fri, 10 Sep 2004 11:23:11 -0400 (EDT) In-Reply-To: from "Paul Schmehl" at Sep 10, 2004 09:49:24 AM X-Mailer: ELM [version 2.5 PL2] MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit cc: shahid@zonewave.net cc: FreeBSD-questions Subject: Re: Phantom /var full messages X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Sep 2004 15:23:18 -0000 > > --On Friday, September 10, 2004 11:58:41 AM +0100 shahid@zonewave.net wrote: > > >> I'm running snort 2.1.3 and mysql 3.23.58 on FreeBSD 4.9 RELEASE. All > >> applications are built from ports. > >> > >> Periodically I get /var full messages and everything comes to a grinding > >> halt. The problem is, /var isn't full. > >> > >> df -h will show /var at 104%, but du -h /var shows /var at 40% (for > >> example). If I shut down snort and mysql, wait for a minute and then > >> start > >> them back up, df agrees with du again. > > > > The best thing to do is increase some more space in /var (as default it is > > 256MB?) - you need to mount /var somehow to 400MB. How to do that? > > How in the world would that help? (BTW, /var is 31GB) The problem isn't > that I'm running out of space. The problem is that df *thinks* I'm out of > space, most likely because of a filehandle problem (but I'll confirm that > here once I figure it out.) No, you are running out of space! DF has nothing to do with it. If one of the processes grabs some file space and then unlinks, it is still holding/using that space and probably needs it, even if one method (df) shows it used and another (du) does not. Don't be fooled by the red herring of du and df disagreeing. Some process is trying to use that space and you need more of it. If you are doing database stuff, then I can't imagine having a /var of less than a few GB, unless you move a lot of stuff out of /var and create links. See some recent previous posts on the subject. ////jerry > > Paul Schmehl (pauls@utdallas.edu) > Adjunct Information Security Officer > The University of Texas at Dallas > AVIEN Founding Member > http://www.utdallas.edu