topic /var filesystem full in Operating System - HP-UX

/var filesystem full

Swetha Lakshmi — Sat, 09 Aug 2008 10:21:01 GMT

Hi,

May i know the resolution steps if /var filesystem is full ??

Thanks & Regards
Swetha

Re: /var filesystem full

Anshumali — Sat, 09 Aug 2008 10:31:11 GMT

/var/adm/syslog move it to some other location or null it, same for other log files there.
>syslog.log
/var/mail/ clear the mailboxes of the persons if they are not using it.
you can do a du -xk /var|sort -k1nr and check for the space consuming files.

Re: /var filesystem full

George_Dodds — Sat, 09 Aug 2008 10:39:03 GMT

you can also null var/adm/wtmp & var/adm/btmp.

If you do copy your /var/adm/syslog/syslog.log file to another directory before you null the original you can always compress it to save disk space.

Re: /var filesystem full

Sridhar R — Sat, 09 Aug 2008 10:43:25 GMT

Swetha,

Also look at the /var/adm/crash directory which may contains big sized crash dump files.

Purge your /var/adm/wtmps files regurlarly, at least once in a month.

You can achieve this via a cron schedule.

Re: /var filesystem full

Deepak Kr — Sat, 09 Aug 2008 10:56:02 GMT

Hi,

First run following:

cd /var
bdf . ====status

sorted list of all dir and files in var
du -sk *|sort -krn

Find out large size files:

find . -xdev -type f -size +100000 -exec ls -lrt {} \+

analyse if you see biggest file related to any logs or any unused data that you can compress or move to some other location.

You can try nullifying

/var/mail/users_files

Re: /var filesystem full

James R. Ferguson — Sat, 09 Aug 2008 11:10:22 GMT

Hi Swetha:

# du -kx /var|sort -k1rn|more

...will produce a descendingly sorted list of the largest directories and files. Do *NOT* manually manage the 'var/adm/sw' directory or its contents! This is your IPD (Installed Product Database). Corruption or deletion of entries herein will render you server unpatchable.

Instead, use:

# cleanup -c 1

...to regain space. See the 'cleanup' man-pages for more information.

Aside from trimming log files like 'wtmp' ('> /var/adm/wtmp'), you can remove old '/var/adm/crash' dumps (if any) and look for old, unused 'vi' recovery files in '/var/preserve'.

Regards!

...JRF...

Re: /var filesystem full

Sajjad Sahir — Sat, 09 Aug 2008 17:36:17 GMT

Dear Swehta

u have to trim log files regularly

for that u can use >logfile

for example

/var/adm/sulog/sulog.log
>/var/adm/sulog/sulog.log

this is the way to trim the log files
/var dir contains log files u have to monitore that one
don't delete any log files just trim thats all
second thing u have to check any dir under var is consuming more space
u can use du -sk /var/* etc...

third u can check any core file is there or not
if core file is there u can easily remove it

thanks and regard

Sajjad Sahir

Re: /var filesystem full

Aneesh Mohan — Sat, 09 Aug 2008 17:45:21 GMT

Hi Swetha ,

The above replies explains clearly about how to house keep the /var filesystem,still it is not under threshold then you may need to plan for extending the filesystem.

Thanks,
Aneesh

Re: /var filesystem full

arun khatwani — Sun, 10 Aug 2008 20:25:15 GMT

Re: /var filesystem full

G.Sivakumar — Mon, 11 Aug 2008 01:58:01 GMT

Hi

cd /var ; du -sk * |sort -n to short list files and dirs by size.

use the below find command to find the largest files you can purge it.
find . -xdev -type f -size +100000 -exec ls -lrt {} \+

You can also remove files from /var/spool/mqueue.
If your compressing the syslog's then after check the daemon the syslog is getting updated or not, if not then you have to restart the syslogd daemon.

Re: /var filesystem full

MarkSyder — Mon, 11 Aug 2008 06:19:49 GMT

If you have root access, you might like to use SAM to trim the files. SAM will automatically create a backup file to a predetermined size (which you can control) and null the existing file.

Mark Syder (like the drink but spelt different)

Re: /var filesystem full

Sp4admin — Mon, 11 Aug 2008 12:10:28 GMT

I would follow the steps that James said. there seem to a log file that is causing the /var to fill up. James made a good suggestion to check the /var/adm/wtmp file. This file gets really large.

sp,

Re: /var filesystem full

SKR_1 — Mon, 11 Aug 2008 16:25:15 GMT

1. You can clear syslog.logs, mail.logs
2. You can gzip sar files inside /var/adm/sa directory.
3. you can delete older crash dumps if they are present inside /var/adm/crash. Check whether if /var/adm/crash is separate FS.

Thanks

SKR

Re: /var filesystem full

Chris Vail — Mon, 11 Aug 2008 19:22:10 GMT

Swetha:
Do not forget to assign points to those who have helped you. All of the replies on this thread are valuable advice. Reward them--it only takes a moment.