topic Re: can't delete file in Operating System - HP-UX

can't delete file

Alain Tesserot — Thu, 11 Aug 2005 15:24:36 GMT

There is a file used by syslogd call /vav/adm/syslog/mail.log
I need to delete that file but get an error that the file doesn't exists yet syslogd keeps appending to the file. I really need to delete that file as it is growing and eventually will fill up the file system.
I thought of running fsck -F vxfs -m /dev/rdsk/c0t0d0s0 but are not sure if the -m option will be usefull on a mounted file system.

Re: can't delete file

RAC_1 — Thu, 11 Aug 2005 15:26:30 GMT

You need to stop processes accessing the file. check those processes.

fuser -u "./file"

Anil

Re: can't delete file

Rick Garland — Thu, 11 Aug 2005 15:28:29 GMT

Do not delete this file.

Instead try this;
# cd /var/adm/syslog
# > mail.log

The mail.log file is a log file for the open process of sendmail. Do a rm on this file and you will not get the inodes.

You can >mail.log or do 'cat /dev/null > mail.log' Both do the same thing

Can't find it? What is in the /var/adm/syslog directory?

Re: can't delete file

Alan Meyer_4 — Thu, 11 Aug 2005 15:29:24 GMT

The processes writing to the file are what is keeping it open and therefore preventing you from actually deleting it. You must find those processes and kill/terminate them. the fuser command will be helpful here.

Re: can't delete file

Sandman! — Thu, 11 Aug 2005 15:29:45 GMT

Try zeroing out that file:

# > /var/adm/syslog/mail.log

cheers!!!

Re: can't delete file

Alan Meyer_4 — Thu, 11 Aug 2005 15:30:28 GMT

there is a log file trimming process available through SAM that might be of help here too...

Re: can't delete file

harry d brown jr — Thu, 11 Aug 2005 15:32:31 GMT

get lsof : http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.75/

use "ls -l" and then "lsof" like this (You had a typo of /vav when I think you meant /var):

[root@vpart1 /var/appl]# ls -l /var/adm/syslog/mail.log
-r--r--r-- 1 root root 3907409 Aug 1 16:57 /var/adm/syslog/mail.log

[root@vpart1 /var/appl]# lsof /var/adm/syslog/mail.log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
syslogd 809 root 9u REG 64,0x8 3907409 10494 /var/adm/syslog/mail.log
[root@vpart1 /var/appl]#

and DO NOT DELETE IT, simply truncate it:

cat /dev/null > /var/adm/syslog/mail.log

live free or die
harry d brown jr

Re: can't delete file

Alain Tesserot — Thu, 11 Aug 2005 15:36:21 GMT

I can't zero out or delete the file yet syslogd is able to write to that file.
I tried doing an fuser -fu /var/adm/syslog/mail.log but get an error that the file doesn't exist so I can't really tell who besides syslogd is using that file.
I tried stoping syslogd and delete the file but no luck. I'm thinking this either a bug or inode corruption.

Re: can't delete file

Alan Meyer_4 — Thu, 11 Aug 2005 15:40:58 GMT

You can truncate the file through SAM using the following selections

Routine Tasks
System Log Files

Select /var/adm/syslog/mail.log

then from the "Actions" menu, select "Trim->Trim to Zero"

Re: can't delete file

Alan Meyer_4 — Thu, 11 Aug 2005 15:42:28 GMT

It ill warn you about active processes having the file open, but select ok and proceed ans the file willbe truncated.

Re: can't delete file

Sandman! — Thu, 11 Aug 2005 15:44:26 GMT

What system/OS do you have? If fuser is not showing what processes are using /var/adm/syslog try lsof as suggested by Harry.

Run lsof on the mounted filesystem that contains the "/var/adm/syslog" directory. You can get that info from bdf as follows:

# bdf /var/adm/syslog

now run lsof on the mntpoint returned by the above command...if it's "/var" then run lsof on it like...

# lsof /var | grep -i "/var/adm/syslog"

this will show what processes are using it.

Re: can't delete file

Rick Garland — Thu, 11 Aug 2005 15:54:45 GMT

If the file does not exist how do you know that the syslogd is writing to this file? Could it be writing to another file? Somewhere else?

If you have no mail.log file in the /var/adm/syslog directory, try to 'touch mail.log' and watch to see if it is increasing in size.

Maybe the mail.log wasn't there but the syslogd says it is writing somewhere.

Re: can't delete file

Alain Tesserot — Thu, 11 Aug 2005 16:04:56 GMT

There is a file /var/adm/syslog/mail.log
If I do ls /var/adm/syslog/ I can see mail.log
If I do touch /var/adm/syslog/mail.log and do ls /var/adm/syslog/ then I see 2 files named mail.log
If I do rm mail.log it removes the one I touched but the original remains and can't be deleted.

I think there may be file system corruption.
Any ideas?

Re: can't delete file

Dietmar Konermann — Thu, 11 Aug 2005 16:10:45 GMT

What about unprintable/control characters in the file name? Check this:

ll /var/adm/syslog | vis

If you see something strange there, check also /etc/syslog.conf using vis(1).

Just my 2 cents...
Dietmar.

Re: can't delete file

RAC_1 — Thu, 11 Aug 2005 16:14:54 GMT

ll | cat -v
ll | vis

There seems to be special char in the file name.

Re: can't delete file

Alain Tesserot — Thu, 11 Aug 2005 16:20:52 GMT

No special characters

Re: can't delete file

Alan Meyer_4 — Thu, 11 Aug 2005 16:26:06 GMT

do an ls -il on the directory to get the inide number of the file and then "find /var/adm/syslog -inum num -exec rm {} \;" to remove the file.

Re: can't delete file

Sandman! — Thu, 11 Aug 2005 16:57:12 GMT

Either remove it as suggested by Alan or zero it out:

# find /var/adm/syslog -inum num -exec cat /dev/null > {} \;

Re: can't delete file

Sandman! — Thu, 11 Aug 2005 17:05:21 GMT

You can try removing it interactively by moving into the "/var/adm/syslog" dir and issuing the "rm -i" command:

# cd /var/adm/syslog

# rm -i *mail*

then answer "y" only to the specific file you want removed.

regards!!!

Re: can't delete file

Alain Tesserot — Fri, 12 Aug 2005 09:03:27 GMT

Thanks everyone

The solution was to use rm -i *mail*
That got rid of the file and I was able to touch a new one and point syslogd to it.