topic Re: /var volume problem in Operating System - HP-UX

/var volume problem

O'lnes — Wed, 04 Sep 2002 02:36:07 GMT

I have two problems in my system:

1.the size of /var volume increase dramatically , but I can't find what file has increased the size , how to avoid it?
2.nothing write to the syslog, the size always is 0 , what is wrong in the file?

Thanks

Re: /var volume problem

Patrick Wallek — Wed, 04 Sep 2002 02:44:08 GMT

What is the exact file name? Make sure it is /var/adm/syslog/syslog.log Make sure there are no non-printable characters. Make sure permissions are correct. Make sure the syslog daemon is running. Make sure syslog.conf file is OK.

As fas as the /var increase, it could be due to print files, mail files, tmp files or other things are there temporarily and once printed or the mail is sent, they are going.

Re: /var volume problem

MANOJ SRIVASTAVA — Wed, 04 Sep 2002 02:50:55 GMT

Hi

YOu mena the size has decreased , /var is the home for lots of logs , all you can do it to do like this

cd /var
ls -l R | grep log and
check for which file is bulky

and trim it .
Check for /var/tmp as this doesnt get cleared when the system is booted

2. cd /var/syslog/syslog.log should ahve some entriers and also check for the soize of OLDsyslog.log
If the size of /var reduces then some logging gets stopped too ,

Manoj Srivastava

Re: /var volume problem

Michael Tully — Wed, 04 Sep 2002 02:55:05 GMT

Hi,

It is a little difficult to stop processes and files using /var as it can be a general dumping area. You can implement script(s) to look after the filesystem monitoring. Attached is a good example from Bill Hassell. To find the sub-directories that contain large amounts of space, run this command(s)

# cd /var
# du -sk * |more

You will most likely find that the problem lies within /var/tmp or if you have done patching recently in /var/adm/sw

Regards
Michael

Re: /var volume problem

Patrick Chim — Wed, 04 Sep 2002 03:23:42 GMT

Hi,

For question 1, the above experts have given you the answer.
For question 2, I have seen it before. Maybe the syslogd daemon is hung up.

You can restart it then,
1. kill `cat /var/run/syslog.pid` and then type /sbin/init.d/syslogd start

OR

2. kill -HUP `cat /var/run/syslog.pid` to let it re-read it's configuration file

To ensure the syslogd is working, it can ftp to the machine with a valid user but wrong password then the syslog.log will show error.

Hope this help,

Regards,
Patrick

Re: /var volume problem

KapilRaj — Wed, 04 Sep 2002 04:12:42 GMT

/var/adm/utmp
/var/adm/wtmp
/var/adm/crash/core*
/var/spool/lp (do not remember the correct path)

hv a look at these files

kaps

Re: /var volume problem

Dirk Wiedemann — Wed, 04 Sep 2002 04:38:50 GMT

Hello,
you ask a lot of questions and receive a good deal of help, but you don't assign points to more than 100 responses.
Are the forums not helpful or jams your assign-button?
regards
Dirk

Re: /var volume problem

Mark Fenton — Wed, 04 Sep 2002 05:03:50 GMT

This happened recently here. The problem turned out to be that there was a "run away" print job that was filling /var. Normal methods of clearing the print spool weren't effective, I had to kill the individual's session.

(We've a fairly large database, but for most users, it's pretty difficult to come up with a query that would spit out more than a few hundred MB of print job -- this talented individual had managed to come up with a job over 8GB!)

good luck.

Re: /var volume problem

Tony Flaherty — Thu, 05 Sep 2002 06:39:26 GMT

hi,

You should be able to identify the big files by using find

cd /var

find . -size +10000000c -exec ls -l {} \;>/tmp/big_files

this will list all files greater than approx. 10Mb, change the value as required.

Tony