Date: Fri, 23 Jan 2004 12:01:31 -0600 (CST) From: James Wyatt <jwyatt@RWSystems.net> To: Lewis Watson <lists@visionsix.com> Cc: freebsd-isp@freebsd.org Subject: Re: NAT and var/log Message-ID: <20040123115110.R18285-100000@kasie.rwsystems.net> In-Reply-To: <014201c3e1cf$cd941620$df0a0a0a@visionsix.net>
next in thread | previous in thread | raw e-mail | index | archive | help
There are a number of things under /var that can fill it up: /var/log, /var/mail, /var/run, /var/tmp. Common things that fill up are large user mailboxes, folks using vi to edit/view a large file, and log files that are deleted while still open. (Other reasons as well, but these are most.) Try doing a "du -kv /var/" and seeing if the total matches what shows as "used" on a "df -k /var/". If there is a large difference, then someone has likely deleted a file that is still open - usually by syslog. You can restart syslog "kill -hup `cat /var/run/syslog.pid`" and see if that helps. If that doesn't work and you can't find who has the file open, you will likely have to reboot. (And educate an admin or user...) If there is no large difference between what du tells you is used by files it can see and df shows the disk has used, then you can look for large files with something like "find /var/ -type f -size +1000 -print". I would look in /var/mail/ and /var/log/ first... If it comes and goes, then it's likely a user that needs to learn "more" and that vi (some versions) keep temp files unless they use read-only mode like "vi -r <file>". No doubt others can offer even better advice - this is a great list in terms of real experience... (^_^) Hope this helps - Jy@ On Fri, 23 Jan 2004, Lewis Watson wrote: > Hi there, > We recently set up a FreeBsd firewall/ router for a client and /var is > getting pretty full. Is there a table or log somewhere in /var that is > filling up? I looked in /var/log and there is nothing here that is out of > the ordinary. I would appreciate any pointers here. > Thanks. > Lewis > > _______________________________________________ > freebsd-isp@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-isp > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040123115110.R18285-100000>