From owner-freebsd-questions@FreeBSD.ORG  Thu Jan 13 22:35:28 2011
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 4925D106566C
	for <freebsd-questions@freebsd.org>;
	Thu, 13 Jan 2011 22:35:28 +0000 (UTC)
	(envelope-from freebsd@edvax.de)
Received: from mx01.qsc.de (mx01.qsc.de [213.148.129.14])
	by mx1.freebsd.org (Postfix) with ESMTP id 0505C8FC15
	for <freebsd-questions@freebsd.org>;
	Thu, 13 Jan 2011 22:35:27 +0000 (UTC)
Received: from r55.edvax.de (port-92-195-143-131.dynamic.qsc.de
	[92.195.143.131]) by mx01.qsc.de (Postfix) with ESMTP id 204EB3E010;
	Thu, 13 Jan 2011 23:35:27 +0100 (CET)
Received: from r55.edvax.de (localhost [127.0.0.1])
	by r55.edvax.de (8.14.2/8.14.2) with SMTP id p0DMZQQC001853;
	Thu, 13 Jan 2011 23:35:26 +0100 (CET)
	(envelope-from freebsd@edvax.de)
Date: Thu, 13 Jan 2011 23:35:26 +0100
From: Polytropon <freebsd@edvax.de>
To: Swe Gill <swegill@gmail.com>
Message-Id: <20110113233526.f396ce52.freebsd@edvax.de>
In-Reply-To: <AANLkTimkY0mNB+DyX0kd_7KxfoPy2ccUTAH361LLQoBa@mail.gmail.com>
References: <AANLkTimk-EXkEKQ80QVBg5utpbt3SU1LK_eAvSfk6Skt@mail.gmail.com>
	<000301cbb307$49788810$dc699830$@com>
	<AANLkTik+sb96kA=R8Bv5uSSc7ZeC-JSDYJb9+QhQ=oE5@mail.gmail.com>
	<AANLkTin4-BwqtaxC1Qy0dABKOGj4Y5XyjM7SiDmSSkeT@mail.gmail.com>
	<AANLkTi=qMBswOhgJH5=uucHcXH7LwrtwZHSz_pTdJF7O@mail.gmail.com>
	<AANLkTi=ume7fwpV91VuzCMkv5krVhdAdGjO6Wb+6AJL3@mail.gmail.com>
	<AANLkTimkY0mNB+DyX0kd_7KxfoPy2ccUTAH361LLQoBa@mail.gmail.com>
Organization: EDVAX
X-Mailer: Sylpheed 2.4.7 (GTK+ 2.12.1; i386-portbld-freebsd7.0)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Cc: freebsd-questions@freebsd.org
Subject: Re: httpd-modsec2_debug.log: Operation not permitted
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Polytropon <freebsd@edvax.de>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 Jan 2011 22:35:28 -0000

On Thu, 13 Jan 2011 23:08:33 +0100, Swe Gill <swegill@gmail.com> wrote:
> That is the problem. One file sizes upto 50GB and other 3 GB...
> 
>  52872944 -rw-rw----   1 root  wheel      50G Jan 13 22:51
> httpd-modsec2_audit.log
>   3320928 -rw-rw----   1 root  wheel     3.2G Jan 13 22:51
> httpd-modsec2_debug.log
> 
> I am just standing nowhere to remove the files....
> 
> have tried by setting flags, changing modes.... all as a root but no luck
> yet...
> 
> Any help?

Is your system running on a raised securelevel maybe? See
in "man security" where this is mentioned, section "SECURING
THE KERNEL CORE, RAW DEVICES, AND FILE SYSTEMS". It seems
that this could cause different behaviour in relation to flags.

I will _not_ advise you to kill the files per inode (fsdb,
clri) because this could cause further filesystem trouble. :-)



-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...