topic Re: /var getting full in Operating System - HP-UX

/var getting full

machaya chivaviro_2 — Thu, 06 Oct 2005 13:32:45 GMT

I need to free space on this file system. What files should I take off.
drwxr-xr-x 12 adm adm 1024 Oct 6 19:07 adm
drwxr-xr-x 4 root sys 1024 Apr 14 19:20 dt
-rw------- 1 root sys 376 Jul 9 2004 history
drwxrwxrwt 2 bin bin 96 May 8 2003 home
drwxr-xr-x 2 root root 96 Sep 23 1999 lost+found
drwxrwxr-x 2 bin mail 9216 Oct 6 20:30 mail
drwxrwxrwx 2 bin bin 96 Sep 23 1999 news
dr-xr-xr-x 15 bin bin 1024 May 8 2003 opt
drwxrwxrwx 2 bin bin 7168 Oct 6 19:07 preserve
drwxrwxrwx 2 bin bin 8192 Jun 1 15:42 rbootd
drwxrwxrwx 3 root sys 96 Sep 19 2002 requests
dr-xr-xr-x 2 bin bin 1024 Oct 6 19:07 run
dr-xr-xr-x 12 bin bin 2048 Oct 6 19:10 sam
dr-xr-xr-x 15 bin bin 1024 Sep 19 17:51 spool
drwxr-xr-x 6 root sys 96 Aug 6 2000 statmon
drwxr-xr-x 5 root other 96 May 8 2003 stm
drwxrwxrwx 21 bin bin 13312 Oct 6 20:30 tmp
drwxr-xr-x 2 root root 2048 Oct 6 19:07 tombstones
dr-xr-xr-x 6 bin bin 96 Sep 28 1999 uucp

Re: /var getting full

Patrick Wallek — Thu, 06 Oct 2005 13:37:06 GMT

Well, this listing really doesn't tell us much.

Things to check in /var:

size of /var/adm/syslog/syslog.log?
size of /var/adm/syslog/mail.log?
Any crashdumps in /var/adm/crash?
Any large files in /var/tmp?
Can you committ superceded patches? (man cleanup for more info.)

Try this to get a listing of the largest dirs in /var:

# cd /var
du -ks * | sort -n

Re: /var getting full

Pete Randall — Thu, 06 Oct 2005 13:38:01 GMT

The only place you can safely delete from is /var/tmp. Others require careful consideration. Use SAM > Routine Tasks to trim logs. Run the cleanup command to commit superceded patches (man cleanup for details). And what is in /var/home?

Pete

Re: /var getting full

Rick Garland — Thu, 06 Oct 2005 13:39:49 GMT

Start by looking to see what is the biggest offender

cd /var
du . -ka | sort -nr | more

This will provide a list of files from biggest in size to smallest.

Look at the /var/adm/syslog directory. Big syslog.log and/or mail.log? (Do not remove these files. Copy them elsewhere and the 'cat /dev/null > syslog.log')

Can you do the 'cleanup' command on committed patches?

Do you have crash dump files residing on the /var partition? If so you might want to remove these.

/var/tmp could be a possible candidate for file truncating/removal.

Is the mail running on this system? What is output of 'mailq' command? If lots you may want to look at /var/mail.

Don't forget some of these directories could be separate filesystems. What is the bdf output?

What you have listed above are mostly directories. Need to look into these directories and see what is present.

Re: /var getting full

Rick Garland — Thu, 06 Oct 2005 13:41:29 GMT

Sorry, command should be 'du . -ks | sort -nr | more'

I have 'du -ka ...'

Re: /var getting full

Devender Khatana — Thu, 06 Oct 2005 13:41:32 GMT

Hi,

Rather than directories see the contents which are occupying more space within these directories. You can not remove any f these directories.

This can be done by

#pwd
/var
#du |sort -rnk 1 |head -20

HTH

Re: /var getting full

Tom Danzig — Thu, 06 Oct 2005 13:43:51 GMT

Typically on most systems, committing patches usually will free up the most disk space. USe:

cleanup -c 1

Re: /var getting full

DCE — Thu, 06 Oct 2005 14:33:15 GMT

/var, by the nature of the files written to it will continously grow unless you monitor it and periodically perform file maintenance. All of your log files go there and most do not have an upper limit i.e. syslog, mail.log wtmp, etc. You cannot simply delete/recreate these files since the system does have them open. you need to do a command such cat /dev/null > /var/adm/syslog to zero out the file (after backing it up)

The software/OS patches are stored there as well. As others has recommended, cleanup -c 1 will remove old superceded patches from the directory. Do not remove them manually s that will cause problems with future patch installs.

/var/tmp is just that a temporary storage area - it should be cleaned up periodically.

Finally /var/spool has the potential for using a lot space - unsent mail messages and prints are queued up there.

Re: /var getting full

Raj D. — Thu, 06 Oct 2005 15:24:00 GMT

Hi Machaya,

1.You can try checking the biggest files on /var first :

# cd /var
# ls -lR | sort +4 -5nr | more

2. Also check the usual files that grows :

/var/adm/syslog/mail.log
/var/adm/syslog/OLDsyslog.log
/var/adm/wtmp

You can nullyfy the mail.log and wtmp

#cat /dev/null > mail.log
or
# >mail.log

Cheers,
Raj.

Re: /var getting full

Vincente Fernandes — Thu, 06 Oct 2005 15:27:34 GMT

/var/adm/sw is another place to check for space. Do a cleanup -p to preview how much space is used by old patches. Then do a cleanup -c 1 to committ old patches which are already superseeded by atleast 1 new patch. This way /var filesystem will be reduced.

Re: /var getting full

Stephen Keane — Fri, 07 Oct 2005 09:30:33 GMT

Also look at /var/adm/crash and make sure you don't have lots of directories such as crash.1 crash.2 etc in there.

Re: /var getting full

Marvin Strong — Fri, 07 Oct 2005 11:44:42 GMT

A bit off topic but you should set /var/preserve to 1777 for security reasons.

If you're running sar, /var/adm/sa can certainly take up alot of space.

If large print jobs go through the host.
you might want to check /var/spool

du -sk * | sort

will give you a good idea where to look.

Re: /var getting full

Marvin Strong — Fri, 07 Oct 2005 11:45:48 GMT

/var/tmp should be 1777 also for security reasons.

Re: /var getting full

machaya chivaviro_2 — Mon, 10 Oct 2005 01:10:37 GMT

du . -ks | sort -nr | more
gave me the following result
881282 .
464860 ./preserve
172382 ./adm
120878 ./stm
99994 ./stm/logs
98498 ./stm/logs/os
57364 ./opt
45942 ./opt/ignite
36210 ./opt/ignite/recovery
34050 ./sam
33672 ./sam/log
19794 ./spool
17678 ./opt/ignite/recovery/2003-05-10,05:59
15606 ./opt/ignite/recovery/2003-05-08,19:15
13860 ./stm/data
13078 ./stm/data/tools
13062 ./stm/data/tools/verify
13060 ./spool/lp
12278 ./spool/lp/request
9156 ./opt/ignite/logs
8028 ./mail
7024 ./stm/config
6998 ./stm/config/tools

Re: /var getting full

Adisuria Wangsadinata_1 — Mon, 10 Oct 2005 01:21:40 GMT

Hi,

You can trim down the system log files at /var file system with SAM :

SAM > routine tasks > system log files

From your info, these file can remove also (since from year 2003, it's Ignite/UX backup archive) :

17678 ./opt/ignite/recovery/2003-05-10,05:59
15606 ./opt/ignite/recovery/2003-05-08,19:15

For safety reason, please do backup before you remove any file from your system.

Hope this information can help you.

Cheers,
AW

Re: /var getting full

Devender Khatana — Mon, 10 Oct 2005 01:55:08 GMT

Hi,

Are there plenty of superceding patches. These can be removed from /var directory using

#cleanup -c 2

Man cleanup for details.

HTH,
Devender

Re: /var getting full

Stephen Keane — Mon, 10 Oct 2005 03:04:33 GMT

What do you have in /var/preserve ? Have you edited a very large file recently and crashed the editor? /var/preserve should mostly be empty.

Re: /var getting full

radi_1 — Mon, 10 Oct 2005 04:45:15 GMT

check the size of /var/adm/wtmp file,if its big,then tail it to a new file,
#cd /var/adm
#tail wtmp >wtmp.new
#cp wtmp.new wtmp
Otherwise search for other big files:
#find /var -xdev -size +10000 -exec ll {} \;

Re: /var getting full

machaya chivaviro_2 — Tue, 11 Oct 2005 12:15:54 GMT

/var/preserve has more files. like
Exaao00482. Can I delete these what are they for.

Re: /var getting full

Devender Khatana — Tue, 11 Oct 2005 12:42:25 GMT

Hi,

Yes these files can be deleted.These are files saved by vi editor perhaps when it crashes or the session having opened that vi session exists abnormally.

The files with old timestamps can be removed easily and the files with recent ones can be moved to some other locations.

HTH,
Devender