topic Re: /var directory still full even after I removed some data in Operating System - HP-UX

/var directory still full even after I removed some data

Joshua Goi — Tue, 07 Dec 2004 11:07:42 GMT

Hi!

My /var directory is still at 100% even after I removed some directories under it. Is it possible there are some log or dump files in there that kept growing? Thanks and appreciate any advise!

Re: /var directory still full even after I removed some data

Rodney Hills — Tue, 07 Dec 2004 11:11:16 GMT

You could have a run away process taking all the space as you free it up.

The file wouldn't show up in the directory until the process closed.

Use "lsof" to try to find the culprit.

HTH

-- Rod Hills

Re: /var directory still full even after I removed some data

A. Clay Stephenson — Tue, 07 Dec 2004 11:12:24 GMT

Your problem is that rm does an unlink and if the link count is now 0 the directory entry is removed BUT the space is only returned to the filesystem when all porcesses which had the file open either terminate or close the file. You need to user lsof or fuser to see what processes still have the file open and kill them.

Man 2 unlink for a better understanding of your problem.

Re: /var directory still full even after I removed some data

Joshua Goi — Tue, 07 Dec 2004 11:14:47 GMT

A runaway process? Exactly how can I find out if it's that's the case?

"lsof" doesn't seem to be a valid command when I typed it.

Re: /var directory still full even after I removed some data

Joshua Goi — Tue, 07 Dec 2004 11:17:12 GMT

I did a reboot after I have removed those directories so that should have killed those processes or any users. But the space is still showing 100%. Weird.

Re: /var directory still full even after I removed some data

Fred Ruffet — Tue, 07 Dec 2004 11:17:46 GMT

All info may be in this thread :
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=757621

Regards,

Fred

Re: /var directory still full even after I removed some data

Fred Ruffet — Tue, 07 Dec 2004 11:30:56 GMT

If you issue a reboot and still have space used, then you didn't remove the good files :)

To see a good report of space, use this :
du -ksx /var/*

This will give you size report for any element under /var. Change /var to anything to find more space-using element.

Regards,

Fred

Re: /var directory still full even after I removed some data

Mark Greene_1 — Tue, 07 Dec 2004 12:29:17 GMT

There are some more obvious places to look.
Do an ls -l on the following:

/var/adm/lp/log <--lp log file
/var/adm/syslog/* <-- syslogd log files
/var/tmp/ <-- system work space
/var/adm/sw <-- lots of log files here
/var/adm/sw/products <-- patch files
/var/lost+found <-- misfiled files
/var/opt/ignite/logs <-- logs from bootable backup

mark

Re: /var directory still full even after I removed some data

Gordon Morrison — Wed, 08 Dec 2004 03:18:23 GMT

You could also try this:

cd /var
touch junk
(delete a file under /var)
find . -newer junk

That should show up the file(s) being written to. Then do either:

> file
(only if the contents are not needed)

or...

fuser

and if it's appropriate, kill the process writing to the file

Re: /var directory still full even after I removed some data

Nguyen Anh Tien — Wed, 08 Dec 2004 04:43:47 GMT

/var contains many kind of log file. each is put in private subdirectory.
You can find bigest directory by using this command
#du -sk /var/* |sort -nr
1144688 /var/adm
207736 /var/opt
13224 /var/stm
4752 /var/dmi
616 /var/sam
528 /var/tmp
408 /var/asx
240 /var/tombstones
144 /var/vx
112 /var/spool
96 /var/yp

and then you track large file in each subdirectory again.
Or you also find big file by using find command.
[trn0:/] find /var -size +10240000c
This command finds all file sized over 10240000byte.
tienna