topic Re: /var is getting filledup regularly in Operating System - HP-UX

/var is getting filledup regularly

j.bobby — Sun, 23 Nov 2008 17:33:07 GMT

Dear guys,

almost in all my unix servers the /var filesystem is growing upto above 90% usage.Can anybody suggest me what are the things we can remove regularly from this /var filesystem.i don't have any printers configured in my servers.Please help me.

thanks & regards
Jagan

Re: /var is getting filledup regularly

Ivan Krastev — Sun, 23 Nov 2008 18:21:39 GMT

Check folders under var for size:

#du -kx /var | sort -rn | head -20

Check also with find for bigger, last modified files.

regards,
ivan

Re: /var is getting filledup regularly

Dennis Handly — Sun, 23 Nov 2008 18:27:04 GMT

What directories are being filled up?
/var/adm/crash/ /var/adm/?
/var/adm/sw/products/?
Various log files that need to be trimmed.
/var/tmp/ user files.

Re: /var is getting filledup regularly

j.bobby — Sun, 23 Nov 2008 21:31:41 GMT

Dear ivan,

please find the output below.

# du -kx /var | sort -rn | head -20
4910704 /var
3762680 /var/adm
1496768 /var/adm/sw
1347448 /var/adm/sw/save
1085424 /var/adm/crash
780216 /var/hp
467288 /var/hp/sgpatch
341648 /var/adm/syslog
312904 /var/hp/patch
275064 /var/adm/crash/crash.11
269968 /var/adm/crash/crash.16
259168 /var/hp/patch/depot
255856 /var/adm/sw/save/PHCO_33081/VEA-FILESET/opt/VRTSob
255856 /var/adm/sw/save/PHCO_33081/VEA-FILESET/opt
255856 /var/adm/sw/save/PHCO_33081/VEA-FILESET
255856 /var/adm/sw/save/PHCO_33081
204608 /var/adm/crash/crash.15
167752 /var/adm/crash/crash.12
153656 /var/opt
146616 /var/hp/sgpatch/depot
#

from the above output pls suggest me to get some free space.

jagan

Re: /var is getting filledup regularly

James R. Ferguson — Sun, 23 Nov 2008 22:08:26 GMT

Hi Jagan:

If the crash dumps in '/var/adm/crash' are old; or they have been analyzed; or you are not interested in having them analyzed and you know why they happened; remove them.

Another directory that usually grows quite large is '/var/adm/sw'. Do NOT manually remove anything in this directory! It is the key to your Installed Product Database (IPD) and without its contents you cannot install or uninstall software let alone properly patch your server.

Instead, you can reclaim space by doing:

# cleanup -c 1

...which is the safe way to manage (remove) unnecessary files in '/var/adm/sw'.

Regards!

...JRF...

Re: /var is getting filledup regularly

Patrick Wallek — Sun, 23 Nov 2008 22:09:10 GMT

I suggest you look at your /var/adm/crash directory. You have approximately 1 GB of space taken up there.

This directory normally contains crash dumps from times when your server crashed. If these crash dumps are old and/or the issue causing the crash(es) has been resolved then they can probably be deleted.

Re: /var is getting filledup regularly

James R. Ferguson — Sun, 23 Nov 2008 22:10:42 GMT

Hi (again) Jagan:

I meant to add that if your server is generating crash dumps "regularly", you need to open a support case with HP Support and have the dumps analyzed. This is not normal nor tolerable.

Regards!

...JRF...

Re: /var is getting filledup regularly

Dennis Handly — Mon, 24 Nov 2008 00:06:21 GMT

>JRF: If the crash dumps in /var/adm/crash are old; or they have been analyzed;

Right. You can also look at the INDEX file in each directory. If the "cause" is the same, you might want to remove everything but that file for all but the last.

Re: /var is getting filledup regularly

Suraj K Sankari — Mon, 24 Nov 2008 04:32:11 GMT

Hi,

Mostly in production environments /var/adm/crash is different FS, so before deleting any files from /var/adm/crash please check is /var/adm/crash FS is under /var ?

Suraj

Re: /var is getting filledup regularly

Dennis Handly — Mon, 24 Nov 2008 04:42:18 GMT

>Suraj: please check is /var/adm/crash FS is under /var?

It was, du -x was used.

Re: /var is getting filledup regularly

SKR_1 — Mon, 24 Nov 2008 05:21:50 GMT

You can create two lvols and mount /var/adm/sw & /var/adm/crash to different mount points. Need to modify /etc/rc.config.d/savecrash file also.

Thanks

SKR