Date: Fri, 23 Jan 2004 12:17:51 -0600 (CST) From: James Wyatt <jwyatt@RWSystems.net> To: Lewis Watson <lists@visionsix.com> Cc: freebsd-isp@freebsd.org Subject: Re: NAT and var/log Message-ID: <20040123121409.X18285-100000@kasie.rwsystems.net> In-Reply-To: <20040123115110.R18285-100000@kasie.rwsystems.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Sorry to follow-up on my own post, but it's "du -kx", not "-kv". The "x" prevents du from wandering into subordinate filesystems mounted under /var/, if you care to know. It can be very handy to mount /var/log/ in append-only mode so the logfiles can't be edited... Thanks - Jy@ On Fri, 23 Jan 2004, James Wyatt wrote: > There are a number of things under /var that can fill it up: /var/log, > /var/mail, /var/run, /var/tmp. Common things that fill up are large user > mailboxes, folks using vi to edit/view a large file, and log files that > are deleted while still open. (Other reasons as well, but these are most.) > > Try doing a "du -kv /var/" and seeing if the total matches what shows as > "used" on a "df -k /var/". If there is a large difference, then someone > has likely deleted a file that is still open - usually by syslog. You can > restart syslog "kill -hup `cat /var/run/syslog.pid`" and see if that > helps. If that doesn't work and you can't find who has the file open, you > will likely have to reboot. (And educate an admin or user...) > > If there is no large difference between what du tells you is used by files > it can see and df shows the disk has used, then you can look for large > files with something like "find /var/ -type f -size +1000 -print". I would > look in /var/mail/ and /var/log/ first... > > If it comes and goes, then it's likely a user that needs to learn "more" > and that vi (some versions) keep temp files unless they use read-only mode > like "vi -r <file>". No doubt others can offer even better advice - this > is a great list in terms of real experience... (^_^) > > Hope this helps - Jy@ > > On Fri, 23 Jan 2004, Lewis Watson wrote: > > Hi there, > > We recently set up a FreeBsd firewall/ router for a client and /var is > > getting pretty full. Is there a table or log somewhere in /var that is > > filling up? I looked in /var/log and there is nothing here that is out of > > the ordinary. I would appreciate any pointers here. > > Thanks. > > Lewis > > > > _______________________________________________ > > freebsd-isp@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-isp > > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040123121409.X18285-100000>