From owner-freebsd-isp@FreeBSD.ORG Fri Jan 23 10:14:10 2004 Return-Path: Delivered-To: freebsd-isp@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 98CE216A4CF for ; Fri, 23 Jan 2004 10:14:10 -0800 (PST) Received: from kasie.rwsystems.net (ea.70.cf9e.cidr.airmail.net [207.158.112.234]) by mx1.FreeBSD.org (Postfix) with ESMTP id 677AF43D64 for ; Fri, 23 Jan 2004 10:14:04 -0800 (PST) (envelope-from jwyatt@RWSystems.net) Received: from localhost (jwyatt@localhost) by kasie.rwsystems.net (8.11.6/8.11.6) with ESMTP id i0NIHqX19210; Fri, 23 Jan 2004 12:17:52 -0600 (CST) (envelope-from jwyatt@RWSystems.net) Date: Fri, 23 Jan 2004 12:17:51 -0600 (CST) From: James Wyatt To: Lewis Watson In-Reply-To: <20040123115110.R18285-100000@kasie.rwsystems.net> Message-ID: <20040123121409.X18285-100000@kasie.rwsystems.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-isp@freebsd.org Subject: Re: NAT and var/log X-BeenThere: freebsd-isp@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Internet Services Providers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Jan 2004 18:14:10 -0000 Sorry to follow-up on my own post, but it's "du -kx", not "-kv". The "x" prevents du from wandering into subordinate filesystems mounted under /var/, if you care to know. It can be very handy to mount /var/log/ in append-only mode so the logfiles can't be edited... Thanks - Jy@ On Fri, 23 Jan 2004, James Wyatt wrote: > There are a number of things under /var that can fill it up: /var/log, > /var/mail, /var/run, /var/tmp. Common things that fill up are large user > mailboxes, folks using vi to edit/view a large file, and log files that > are deleted while still open. (Other reasons as well, but these are most.) > > Try doing a "du -kv /var/" and seeing if the total matches what shows as > "used" on a "df -k /var/". If there is a large difference, then someone > has likely deleted a file that is still open - usually by syslog. You can > restart syslog "kill -hup `cat /var/run/syslog.pid`" and see if that > helps. If that doesn't work and you can't find who has the file open, you > will likely have to reboot. (And educate an admin or user...) > > If there is no large difference between what du tells you is used by files > it can see and df shows the disk has used, then you can look for large > files with something like "find /var/ -type f -size +1000 -print". I would > look in /var/mail/ and /var/log/ first... > > If it comes and goes, then it's likely a user that needs to learn "more" > and that vi (some versions) keep temp files unless they use read-only mode > like "vi -r ". No doubt others can offer even better advice - this > is a great list in terms of real experience... (^_^) > > Hope this helps - Jy@ > > On Fri, 23 Jan 2004, Lewis Watson wrote: > > Hi there, > > We recently set up a FreeBsd firewall/ router for a client and /var is > > getting pretty full. Is there a table or log somewhere in /var that is > > filling up? I looked in /var/log and there is nothing here that is out of > > the ordinary. I would appreciate any pointers here. > > Thanks. > > Lewis > > > > _______________________________________________ > > freebsd-isp@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-isp > > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"