/var is at 90% capacity

[Larry De Clay]

Jude,
Somebody turn on the auditing and the output files are in /var/audit.
If you doesn´t take care of that you could delete them. The best way is delete the oldest.

Good luck,
Larry

[Harmanjit_1]

Hi,

You can stop and then restart audit process again which will automatically zip this 14gb file and free up the space and will create new log file.

/sbin/init.d/audit stop

and then

/sbin/init.d/audit start

[DCAdmin_1]

Thank you all for your suggestions. I deleted the audit files and kept the most current. This forum is great and I will definitely continue to log in here to get help. I would like to get to a point where I can help someone as well. Have a great weekend.

[Ann Majeske]

For more information on the Audit subsystem see Chapter 3 of the Security Administration manual and the man pages for auditd, auditmask, and audit_tool.

You should probably reconfigure auditing to use up less space, depending on what your auditing requirements are. Does your company have a Security Policy that you are required to follow? This would have your auditing requirements in it. If you have a requirement for auditing you probably also have a requirement for saving the audit logs for a certain period of time, so you might want to look into setting up a procedure to periodically backup and delete old audit logs.

Ann

[Ann Majeske]

One other thing, you don't need to stop and restart the audit daemon to start logging to a new file the command:
# auditd -dx
will empty the audit buffers into the current log file and start logging to the next file, see the man page for auditd for more details.

Ann

[Manish PATHAK_2]

If the problem is still there can you please check whether collect utility is running or not and if yes then at what time interval....

because it generates so many files andcan also be one of the reason...

Further it will be very useful if you can submmit the output of following commands...

ls -als /var
df -kh
du -sk /var

Regards
Manish Pathak

[Pushker Sahai]

you can use
#cleanup -c 3
#cleanup -c 2
#cleanup -c 1

to delete superseeded patches and this can
give you some space on /var