root directory is 100%. unable to identify file trimmable and no more pv to extend

[apple]

Dear HPUX gurus,
I was in dilemma. Im unable to identify the trimmable files in root directory. it looks to me os related files which i can't trim ie /opt, /etc.Attached is the command that i use:
find / -size +2048, find /opt -size +2048
Appreciate your reply. Many thanks. Hope to hear from you.

[Vijaykumar_1]

/opt is a different filesystem.

find /filesystemname -xdev -size +1000000c -exec ll {} \; |sort -rnk 5 |more

Use the above command to identify the large files ..

[apple]

Dear Sir,
Thank you
Attached is the output. what are the criteria of files trimmable in /etc and /sbin? Hope to hear from you. Many thanks in advance.

[Jim Walls · Accepted solution]

/.secure/etc/audfil

This looks like the culprit. If you do not require Auditing simply delete it - and then use SAM to turn off the audit functions.

If you do require Auditing then you should move this very large file into a more suitable file system. An probably switch off Auditing until you can set up a proper file management regime.

Take note that Auditing generates large amounts of data, which has to be carefully managed.

[Taifur]

Hi,

Ur root directory is 100% full , u can check by rebooting the server , if possibl and also check is there any core file resides in root directory, if found simply delete core file.

Cheers//
Taifur

[Vijaykumar_1]

You need not house keep /etc and /sbin. These directories contain the system configuration files and commands..

Instead you need to find other files, else extend the root FS.

[Akif_1]

Hi APPLE,

I agree with our colleague regarding deleting below file you can reduce the size and stop auditing, If u need in future keep a tab on this folder.

-rw------- 1 root root 1801535478 Jun 28 11:15 /.secure/etc/audfil
e2


How to reduce file size=0:

cp /dev/null file

(or)
dd if=/dev/zero of=output.file bs=1 count=1

Rgd's

[apple]

Dear Sir,
Many thanks.
what is the safest and permanent step to disable the audit?
How to know the system is trusted system? do I need to handle it specially?
Sir, is it possible to list the steps? Hope to hear from you.
do i need to stop the audit service first, disable it and only nullify the file? Hope to hear from you. Many thanks in advance.

[Kapil Jha]

you can stop auditing from sam
or
/sbin/init.d/auditing stop

you can delete the old auduting files without issue, but take proper approval before stopping auditing caouse its important from security point of view.

BR,
Kapil+

[apple]

# /sbin/init.d/auditing stop
auditing system halted
audomon stopped
and nullify the file. it does wonder. Many thanks