/var 99%

[Pedro Luis Estraño]

Why the file system /var is 99%?
what would I check?

Thank

[Patrick Wessel]

Check if there are any dumps in /var/adm/crash

[Andy Monks · Accepted solution]

You might have lots in /var/adm/sw/patches too

Assuming you don't ever want to back out a patch you can do :-

swlist -l fileset -a name | grep PH > /tmp/patchlist
swmodify -x patch_commit=true -f /tmp/patchlist

[Andreas Voss]

Look at /var/adm/wtmp
It's the history file for logins
You can shrink it with:
:>/var/adm/wtmp

[James R. Ferguson]

Pedro:

You might want to run cleanup (see man pages) to remove swinstall's saved patch files no longer needed.

You might also want to use SAM (routine_tasks -> system_log_files) to trim the sizes of log files.

...JRF...

[Anthony deRito]

In addition to the suggestions mentioned above, you can get a glimpse of what directories are consuming the most space by:

#cd /var
# du -x | sort -n

You will notice the block counts on the left and the directories on the right. Look at the bootom of the list to see the directories that have the largest block count. These are 512 byte blocks. This will give you a good idea of directory sizes.

To find large files, use the folowing command:

#cd /var
#find . -xdev -size +$1c -exec ll -lt {} ;

Start with $1 set to a moderate number like 5000000 then run the command again while increasing the value of $1 to shrink the list and find the largest files.

Hope this helps.

Tony

[Fred Martin_1]

Don't forget that /usr/tmp is normally a link to /var/tmp ... so check /usr/tmp for large junk files.

[Jamie Rancourt]

Also, verify that sendmail is working. the mail queue is located in /var/spool/mqueue and can fill up quite quickly.

Jamie

[John Hall]

Pedro,

As you can see from previous suggestions there are many places you can look to free up space. To summarize:

1) /var/mail (you can edit the mail files for other users to delete old mail)

2) /var/adm/crash (if crash files are old or unneeded then delete them)

3) /var/tmp (fills up with various system overhead files: CRON output, aborted editor sessions, etc. Be careful about deleting these files because they could be currently in use. Do "cd /var/tmp; ls | xargs -i -t fuser -fu {}" and the files being used will appear as "myfilename: 12345o(userid)", you can delete the ones not in use.

4) /var/preserve (old aborted shell sessions(?), etc)

5) The cleanup utility will trim the system log files and will remove installed patch files (which will commit them). First backup all files and directories under /var/adm/sw/patch. If cleanup is not installed then install patch "PHCO_12140 B.10.00.00.AA patch cleanup utility" and execute "cleanup -F".

-Good hunting!

[Vincente Fernandes]

Besides /var/adm/sw/patches, /var/adm/cron, /var/adm/wtmp, /var/adm/btmp, /var/mail etc. one more important directory is /var/adm/syslog. Usually most of the time this directory also occupies space as file "syslog.log" goes on filling up daily. These depends upon what at whate level debugging is set with syslogd daemon. I found on our servers "syslog.log" file goes on increasing like anything on a daily basis, so i used a script a trim the file accordingly.