topic Re: removing files from /var file system in Operating System - HP-UX

removing files from /var file system

Shivkumar — Wed, 14 Dec 2005 14:58:29 GMT

Dear Sirs,

We get alerts from the /var file system getting filled up.
We are thinking remove some depot file from there. I am not sure after installation of patches, can we remove
the depot files from there ? Will it have any impact on the already installed binary ?

Which are directories under /var file system from where we can delete the files ?

Thanks,
Shiv

Re: removing files from /var file system

Deoncia Grayson_1 — Wed, 14 Dec 2005 15:06:42 GMT

you do not want to delete any depots under /var, what you might consider doing is running cleanup -c 1 which commits any patches that has been superseded one time and also check for /var/preserve which sometimes can have huge files and make sure you have a trim script in place that will keep syslogs/mail/cron logs from becomming to large and also monitor the size of wtmp which is located under /var/adm

BTW what is the size of var on your server?

Re: removing files from /var file system

Andy Torres — Wed, 14 Dec 2005 15:11:59 GMT

You decide if you want to keep the original depot or not. Take a backup if possible, or copy it to another filesystem with plenty of space. From there you can gzip it, back it up, THEN remove it if it makes you feel more comfortable.

Do a swlist -l depot to see if the depot is a registered depot. If you no longer need the depot, do a swreg -u -l depot /path/to/depot to unregister it.

Re: removing files from /var file system

Andy Torres — Wed, 14 Dec 2005 15:17:54 GMT

To be clear, I am not advocating the removal of any software under /var/adm/sw. When I say "original depot" I mean the one you downloaded and installed.

For example, I have a depot I downloaded from HP located under /var/tmp/ANDY/PRM_PATCHES/depot. Once I installed it I verified the installation (swlist -l fileset -a state | grep -v "^#" | grep -v configured). Only then did I comfortably remove /var/tmp/ANDY and unregister the depot.

Re: removing files from /var file system

James R. Ferguson — Wed, 14 Dec 2005 15:21:54 GMT

Hi Shiv:

Whatever you do, do NOT manually maintain '/var/adm/sw'. This is your IPD (Installed Product Database) used by 'swinstall' and the other Software Distributer tools.

The safest way to regain space is to run 'cleanup -c 1'. This removes all but one roll-back patch imsage.

If you have "*.depot" files and or patches (PH*_*) in '/var/tmp' then these can be removed when you are done with them, without harm.

Regards!

...JRF...

Regards!

...JRF...

Re: removing files from /var file system

Justin_132 — Wed, 14 Dec 2005 15:30:53 GMT

Hi Shiv,

Y cant u try a "find" for logs inside your /var before thinking of cleaning up your sw and patches..

Some of your applications can keep old logs files which can be deleted. Even you can search for "core" dumps and touch that..

Just_In

Re: removing files from /var file system

Geoff Wild — Wed, 14 Dec 2005 15:31:01 GMT

For cleaning patches:

cleanup -c 1

To check other possibilities:

du -sk /var/* |sort -n

Rgds...Geoff

Re: removing files from /var file system

Andy Torres — Wed, 14 Dec 2005 15:31:41 GMT

The cleanup utility is a good idea. You can run it in preview mode first (cleanup -p -c 1) to see what you will gain. If you upgraded to 11.x from 10.x, the -i option can suprise you.

Read the man page on cleanup so you fully understand the weight of committing patches.

I usually start with 'cleanup -p -c 2' and get more brave from there, depending on the server (production/development).

Re: removing files from /var file system

Rick Garland — Wed, 14 Dec 2005 16:26:04 GMT

This command may help

# cd /var
# du . -ka -x | sort -nr | more

This du command will list the files in ascending order by sizes.

As previously stated, use cleanup command to reduce the patch database size.

Also look in the /var/adm/syslog. Do you have large syslog.log and/or mail.log files?

Is the crash directory on the same mount point as /var? Do you have crash dumps in there?
You may want to put the /var/adm/crash on its own filesystem.

Re: removing files from /var file system

Raj D. — Wed, 14 Dec 2005 17:08:57 GMT

Hi Shiv ,

Check for the big files under /var and you can find some big files or logs.
You can use :
# bdf | grep var # ( check if only var mount point exists).

# cd /var
# ls -lR | sort +4 -5nr | more
( It will show all the biggest files one by one..)

Also check for
/var/adm/syslog/syslog.log
/var/adm/syslog/OLDsyslog.log
/var/adm/syslog/mail.log
/var/adm/wtmp
/var/adm/cron/log

You can nullyfy the files or move to other place to recover free space.

Cheers,
Raj.

Re: removing files from /var file system

Arunvijai_4 — Wed, 14 Dec 2005 22:36:15 GMT

Shiv, You can use # cleanup -c 1 to clean your depots. Also, look at /var/adm/crash and you can delete unwanted crash dumps. You can delete your old syslog files at /var/adm/syslog dir.

-Arun

Re: removing files from /var file system

Yogeeraj_1 — Wed, 14 Dec 2005 23:26:25 GMT

hi shiv

i would also recommend that you go through "Routine Tasks" in SAM and purge all your old logs first

this hopefully will clear up a bit of space.

hope this helps too!

kind regards
yogeeraj

Re: removing files from /var file system

Arunvijai_4 — Wed, 14 Dec 2005 23:55:03 GMT

A good thread worth reading,

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=977812

-Arun

Re: removing files from /var file system

Shivkumar — Thu, 15 Dec 2005 02:07:12 GMT

Sirs,

I just ran the command "# cleanup -p -c 2"
and got the below output on test box:-

The following patches superseded at least 2 time(s) can be committed:

Superseded # Times Superseded Disk Space in /var/adm/sw/save Superseded By
========== ================== ============================== =============
PHCO_24813 2 495616 bytes PHCO_26700
PHCO_25082 2 151552 bytes PHCO_26561
PHCO_25311 2 3426304 bytes PHCO_26824
PHCO_25452 3 23476224 bytes PHCO_27434
PHCO_27020 2 571392 bytes PHCO_28259
PHCO_27209 2 385024 bytes PHCO_27243

can anyone explain what this output says ?

Re: removing files from /var file system

Shivkumar — Thu, 15 Dec 2005 02:14:54 GMT

also i saw some depot files in the directory /var/opt/patches. should i delete these depot files ?

Re: removing files from /var file system

Henk Geurts — Thu, 15 Dec 2005 02:15:18 GMT

you ran a preview for a cleanup which shows you:
the superseded patch
the times its been superseded
the disk space it uses
the patch it has been superseded by.

for the actual cleanup leave the -p out of the command.
regards.

Re: removing files from /var file system

Henk Geurts — Thu, 15 Dec 2005 02:23:17 GMT

make sure the are not used (fuser) or registered as depot (swlist -l depot).
if the depot is registered , use :

swreg -u -l depot /var/opt/patches

Re: removing files from /var file system

Arunvijai_4 — Thu, 15 Dec 2005 03:17:19 GMT

It means, You have installed latest patches and old patches were superseded. You can do that cleanup safely. Also, Check swreg to see that the depots are registered.

-Arun

Re: removing files from /var file system

Mohan_24 — Thu, 15 Dec 2005 06:41:55 GMT

you can run cleanup -c 1 and remove patches that are superseded at least 1 time.
you may want to run swreg -u -l depot /var/opt/patches to register patches before running the cleanup.