topic Re: how to use "ls" to search the biggest files in /var? in Operating System - HP-UX

how to use "ls" to search the biggest files in /var?

thebeatlesguru — Thu, 26 Dec 2002 01:40:07 GMT

how can i do that?
find the biggest files in /var?

Re: how to use "ls" to search the biggest files in /var?

Patrick Wallek — Thu, 26 Dec 2002 02:03:33 GMT

# ls -l | sort +4nr

will show largest files first

# ls -l | sort +4n

will show largest files last

If you want the whole /var directory structure use 'ls -lR' in the above command lines.

It would probably be easier to use du to do this though.

# du -k * | sort

should get you something close to what you want.

Re: how to use "ls" to search the biggest files in /var?

Rajeev Shukla — Thu, 26 Dec 2002 02:06:26 GMT

Hi use find command instead.
syntax...
find /var -size +1000000c -exec ll {} \;

this will list all files greated than 1MB.
For more information do man on find command.

Cheers
Rajeev

Re: how to use "ls" to search the biggest files in /var?

Patrick Wallek — Thu, 26 Dec 2002 02:12:20 GMT

A correction to my last post.

The syntax for the du command with sort is:

# du -k * | sort -n
Will sort smallest to largest

# du -k * | sort -nr
Will sort largest to smallest

Re: how to use "ls" to search the biggest files in /var?

T G Manikandan — Thu, 26 Dec 2002 03:11:05 GMT

Do a
#du -k /var|sort -nr
This will list the greater MB size in descending order.

WHat you can check is for
check for these dir

/var/adm/crash
/var/tombstones
/var/adm/syslog/
/var/mail
/var/adm/wtmp

/var/opt/ignite

ALso you can clean the /var/tmp
remove the files which were not accessed for the past 7 days
find /var/tmp -atime +7 -exec rm {} \;

REmove the unrequired files and clean the file system.

Re: how to use "ls" to search the biggest files in /var?

Bill Hassell — Thu, 26 Dec 2002 03:50:14 GMT

Be careful in looking for big files. Quite often, a programming mistake will leave thousands of small files that will be missed by the find command (looking for 1meg or larger). /var s the busiest filesystem in HP-UX and MUST be actively managed, that is, logfiles and temp files must be trimmed.

As mentioned, du -k is the preferred command because it shows the biggest directories. Once you see the biggest directories, look inside the directory and sort files by size using:

ll | sort -rnk5 | more

Files that will grow very large are logfiles in /var/adm and also /var/adm/sw where patches and other rollback files are stored. /var/adm/sw is always a candidate for a separate volume.

Re: how to use "ls" to search the biggest files in /var?

Yogeeraj_1 — Thu, 26 Dec 2002 04:41:35 GMT

hi,

concerning du:

i prefer to use the -s option which allows me to print only the grand total of disk usage for each of the specified name operands.

E.g.
# du -sk /var/*
0 /var/X11
282551 /var/adm
20 /var/dt
0 /var/lost+found
255 /var/mail
0 /var/news
55453 /var/opt
1441 /var/preserve
0 /var/rap
0 /var/rbootd
2 /var/run
23428 /var/sam
403 /var/spool
2 /var/statmon
15106 /var/stm
17714 /var/tmp
402 /var/tombstones
0 /var/uucp
40 /var/yp
#

Then i drill down the directories in search for any suspicious files.

Please note that in SAM->Routine Tasks you already have a list of selected OS logfiles that alleviates the logfile trimming tasks of SysAdmins.

Cheers
Yogeeraj

Re: how to use "ls" to search the biggest files in /var?

thebeatlesguru — Thu, 26 Dec 2002 04:53:08 GMT

i found these are a lot of big files in /var/stm/logs/os
*.raw files

Re: how to use "ls" to search the biggest files in /var?

Yogeeraj_1 — Thu, 26 Dec 2002 05:15:48 GMT

hi again,

Before you delete any raw logfile file, you must find out WHY its got so big! Each file is written to every time a significant hardware event occurrs, so it could be some component on your system is failing.

Before deleting any file, you should first tell STM to start using a new log.

Please see the following post:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x20e191ccb36bd611abdb0090277a778c,00.html
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x5b3d7b8d1de3d5118ff40090279cd0f9,00.html

Cheers
Yogeeraj

Re: how to use "ls" to search the biggest files in /var?

Fragon — Thu, 26 Dec 2002 05:41:29 GMT

For safty reason,you should not delete these files directly instead of empty them. Normally we use
#> logfile
to empty the log file.

Re: how to use "ls" to search the biggest files in /var?

T G Manikandan — Thu, 26 Dec 2002 14:13:25 GMT

Do not delete the two files in the /var/stm/logs/os

logN.raw.cur
memlog
memlog is used for memory logging.
logN.raw.cur is the current log file for stm.

However you can delete the other old log files provided you will miss the old data.

check this link on the stm logging.

http://www.docs.hp.com/cgi-bin/otsearch/getfile?id=/hpux/onlinedocs/diag/logtool/log_data.htm&searchterms=/var/stm/logs/os&queryid=20020218-001728

Revert

Re: how to use "ls" to search the biggest files in /var?

Fred Martin_1 — Fri, 27 Dec 2002 13:55:23 GMT

I have a script called "biggest" which contains the following single line:

ls -l | awk '{printf("%10s:%s\n",$5,$0)}' | sort | cut -c12-

In my case, I 'cd' to a directory and run 'biggest' ... it displays the biggest files with formatted output.

If you wanted something that would traverse directories, you could use this as a starting point.

Fred

Re: how to use "ls" to search the biggest files in /var?

Steven E. Protter — Fri, 27 Dec 2002 14:18:29 GMT

A useful 10 point script(hint hint) that you can modify for your own use.