find growing files

[Dennis Handly]

>I have to install the lsof utility and it's a production server.

You don't have to reboot.

>part contents deleted and kept back

Has the file changed at all since that was done?

[arkie]

The file changed from approx. 18Mb to current 1.95Mb.

Regarding lsof, where can I download the appropriate utility for HP-UX B.11.11. What can be the risks involved.

[R.K. #]

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.82/

As said, it do not require reboot, you can go ahead and install it.

[Dennis Handly]

>The file changed from approx. 18Mb to current 1.95Mb.

Has it been modified since you manually edited it?

[arkie]

No the file has not been modified in the last 4 days.

Also, when trying to install lsof, I am getting the following error:-

# swinstall -s /tmp/lsof/lsof-4.82-hppa-11.11.depot \*
WARNING: Cannot lock "/var/adm/sw/queue/number.lck" because another
command holds a conflicting lock. The process id of that
command is -1.
ERROR: The attempt to create the job failed. (Internal error)

ERROR: Command line parsing failed.

[R.K. #]

Hi..

>>> WARNING: Cannot lock "/var/adm/sw/queue/number.lck"

Another SD command is running that prevents the swinstall or swremove command from running. Wait for that command to finish and try again.

You can also check from "ps -ef" if any SD command is running.

[arkie]

Checked the /var/adm/sw/swagentd.log file and found following excerpts:-

...
ERROR: Cannot lock depot/root at "/" due to fcntl() error "ENOLCK".
If the soc is on a remote NFS file system, the NFS locking
facility is probably inactive or having problems. If it is on
a local file system, this indicates too many locks are already
in use and no more are available.
...

Is it likely because this is a node of a 2-node cluster

[Bill Hassell]

Looking for big files or looking for recent files doesn't work that well. You are looking for changes in disk space so start with the largest directories. Use this:

# du /oracle/N11/920_64 | sort -rn | head -20

Those top 20 directories are the most important. Should each one be that large (you need to know what the directory is supposed to contain)? If one of the directories seems too large then sort the files in that directory by size:

# cd /oracle/N11/920_64/BIG_directory
# ll | sort -rnk5 | head -20

This technique finds those pesky directories where all the files are less than 1 MB but there are (unexpectedly) thousands of them.

To watch this directory, run the du command above and see what is growing. Note that log files can be removed but the space won't change until the process that had the logfile open closes the file.