From owner-freebsd-isp@FreeBSD.ORG Fri Jan 23 10:02:15 2004 Return-Path: Delivered-To: freebsd-isp@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D7E1F16A4CF for ; Fri, 23 Jan 2004 10:02:15 -0800 (PST) Received: from kasie.rwsystems.net (ea.70.cf9e.cidr.airmail.net [207.158.112.234]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7AC1F43D6E for ; Fri, 23 Jan 2004 10:00:54 -0800 (PST) (envelope-from jwyatt@RWSystems.net) Received: from localhost (jwyatt@localhost) by kasie.rwsystems.net (8.11.6/8.11.6) with ESMTP id i0NI1VL18899; Fri, 23 Jan 2004 12:01:31 -0600 (CST) (envelope-from jwyatt@RWSystems.net) Date: Fri, 23 Jan 2004 12:01:31 -0600 (CST) From: James Wyatt To: Lewis Watson In-Reply-To: <014201c3e1cf$cd941620$df0a0a0a@visionsix.net> Message-ID: <20040123115110.R18285-100000@kasie.rwsystems.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-isp@freebsd.org Subject: Re: NAT and var/log X-BeenThere: freebsd-isp@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Internet Services Providers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Jan 2004 18:02:16 -0000 There are a number of things under /var that can fill it up: /var/log, /var/mail, /var/run, /var/tmp. Common things that fill up are large user mailboxes, folks using vi to edit/view a large file, and log files that are deleted while still open. (Other reasons as well, but these are most.) Try doing a "du -kv /var/" and seeing if the total matches what shows as "used" on a "df -k /var/". If there is a large difference, then someone has likely deleted a file that is still open - usually by syslog. You can restart syslog "kill -hup `cat /var/run/syslog.pid`" and see if that helps. If that doesn't work and you can't find who has the file open, you will likely have to reboot. (And educate an admin or user...) If there is no large difference between what du tells you is used by files it can see and df shows the disk has used, then you can look for large files with something like "find /var/ -type f -size +1000 -print". I would look in /var/mail/ and /var/log/ first... If it comes and goes, then it's likely a user that needs to learn "more" and that vi (some versions) keep temp files unless they use read-only mode like "vi -r ". No doubt others can offer even better advice - this is a great list in terms of real experience... (^_^) Hope this helps - Jy@ On Fri, 23 Jan 2004, Lewis Watson wrote: > Hi there, > We recently set up a FreeBsd firewall/ router for a client and /var is > getting pretty full. Is there a table or log somewhere in /var that is > filling up? I looked in /var/log and there is nothing here that is out of > the ordinary. I would appreciate any pointers here. > Thanks. > Lewis > > _______________________________________________ > freebsd-isp@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-isp > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org" >