From owner-freebsd-questions Sun Jun 9 12:56:37 2002 Delivered-To: freebsd-questions@freebsd.org Received: from nebula.x509.com (nebula.x509.com [199.175.150.19]) by hub.freebsd.org (Postfix) with ESMTP id CDDC037B405 for ; Sun, 9 Jun 2002 12:56:31 -0700 (PDT) Received: from crack.x509.com (mail.x509.com [199.175.150.1]) by nebula.x509.com (8.11.6/XCERT) with ESMTP id g59JuMg13722 for ; Sun, 9 Jun 2002 12:56:22 -0700 (PDT) Received: from exvan01.x509.com (exvan01.x509.com [10.9.22.50]) by crack.x509.com (8.11.6/XCERT) with ESMTP id g59JuL419131 for ; Sun, 9 Jun 2002 12:56:21 -0700 (PDT) Received: by exvan01.x509.com with Internet Mail Service (5.5.2653.19) id ; Sun, 9 Jun 2002 13:00:12 -0700 Received: from mikko.na.rsa.net (10.104.88.115 [10.104.88.115]) by exna00.securitydynamics.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id M28ZMP6V; Sun, 9 Jun 2002 15:55:40 -0400 Received: from mikko.na.rsa.net (localhost [127.0.0.1]) by mikko.na.rsa.net (8.12.3/8.12.3) with ESMTP id g59JtXl0010660 for ; Sun, 9 Jun 2002 12:55:34 -0700 (PDT) (envelope-from mikko@mikko.na.rsa.net) Received: (from mikko@localhost) by mikko.na.rsa.net (8.12.3/8.12.3/Submit) id g59Jt2kj010659; Sun, 9 Jun 2002 12:55:02 -0700 (PDT) Date: Sun, 9 Jun 2002 12:55:02 -0700 (PDT) From: Mikko Tyolajarvi Message-Id: <200206091955.g59Jt2kj010659@mikko.na.rsa.net> To: sroberts@dsl.pipex.com Cc: questions@freebsd.org Orig-To: "S. Roberts" Subject: Re: Strange size increase in /var Newsgroups: local.freebsd.questions References: <1023648827.318.73.camel@Demon.Strobe.org> Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG In local.freebsd.questions you write: >Hello, > Over the last two days, I've noticed a significant increase in the >size of /var on this system: ># df -k >Filesystem 1K-blocks Used Avail Capacity Mounted on >/dev/ad0s1a 148823 42962 93956 31% / >/dev/ad0s1f 11789353 1527589 9318616 14% /usr >/dev/ad0s1e 297663 51443 222407 19% /var >procfs 4 4 0 100% /proc ># >Normally /var would come in at around 13% - 14%, as was the case this >time last week, I believe. >Here's what du returns: ># pwd >/var ># du -h -d0 > 50M . ># du -h -d1 >1.0K ./account >3.0K ./at > 11K ./backups >2.0K ./crash >3.0K ./cron > 24M ./db I'd check this: du -k /var/db Unless you have any applications storing data here, most of the space is usually consumed by /var/db/pkg (depending on how many ports or packages you have installed). >1.0K ./heimdal > 14M ./log >1.0K ./mail >2.0K ./msgs >1.0K ./preserve > 56K ./run >1.0K ./rwho > 11M ./spool Most likely culprit. du -k /var/spool. Something may have been been queued up (mail, printjobs). If there are users on this machine, someone may have put something in /var/spool/uucppublic (publicly writable, you might as well delete it unless you are actually using uucp). On a virgin system /var/spool is less than 100K. >2.0K ./tmp > 20K ./yp > 62K ./games >2.0K ./lib > 50M . I suppose a stray core file is a possibility too. $.02, /Mikko -- Mikko Tyolajarvi_______________________________________mikko@rsasecurity.com RSA Security To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message