root full---not resolved

[subodhbagade]

hello all Experts... ....

we having 11.11 Hp-unix server and sap running on it.

initialy we are not able to login quality server... it showing server unexpectedly close net work connection.

and error was /etc/pam.conf is missing

so we had done the following steps.

(1)we rebooted the server into single user mode and

Cp -R –p usr/newconfig/etc/pam.conf /etc/pam.conf and set the permission
-r--r--r-- 1 root sys pam.conf

(2) we rebooted the server again.

(3)After rebooting the server root (file system ) become 100%...

(4)Is the root become 100% because of replacing /etc/pam.conf ???????? or whatever activity we had done....

(5)# ll /core*
/core* not found no core file is find ....

# pwd
ls

.Xauthority .rhosts ThrSaveSPAFields: lvoltest sapswap test
.Xauthority.new .sh_history net sbin testr
.Xauthority.old .ssh bin nsr
.gpmhp-lathstg .sw cdrom stgtmp14oct tmp_mnt
.profile SD_CDROM dev usr
.profile.bak ThCallHooks: error.file lib var
.pvprinters_ver1 ThrSaveSPAFields etc lost+found wan
#

(6)# du -kx / | sort -rn | head -20
188856 /
139872 /etc
63448 /etc/vx
48256 /sbin
34120 /etc/opt
32960 /etc/vx/type
29472 /etc/vx/static.d
28760 /etc/vx/static.d/build
25120 /etc/lvmconf
24336 /etc/opt/resmon
17808 /etc/opt/resmon/lib
14920 /etc/vx/type/static
8952 /etc/vx/type/gen
8320 /etc/lp
6776 /etc/vx/type/raid5
6560 /etc/lp/interface
6232 /etc/opt/OV/share
6232 /etc/opt/OV
5928 /sbin/fs
5512 /etc/opt/OV/share/conf

this are the large files present ...

(7)vgdisplay -v /dev/vg00 showing all lv no pv related issue.....

(8)can we move any of listed file or
can we create a seperate mount point (creating new lv ) any one of above...or
can we make soft link of above or

(9)we don't have /sbin/init.d/nohup.out log which we can move.

How could i make root FS more free / resolve this issue on urgent basis.....

Please help me i am badly stuck with this issue .....

Thanks in advance.....

Regards,
subodh.

[Ivan Krastev]

Use find and search for big files, last modified files to have more information.

regards,
ivan

[Robert-Jan Goossens]

Hi Subodh,

----
(6)# du -kx / | sort -rn | head -20
188856 /
----

And what is the actual volume size for /, is it 200MB?

# bdf /

Regards,
Robert-Jan

[Wim Rombauts]

Maybe, start trying "find / -type f -mtime -1". This will list all files modified/created the last 24 hours.

Maybe some process started looping and you have a directory with an incredible amount of small files. Thes files will not show up in your du output, becuase they are too small.

[Steven E. Protter]

Shalom,

Implement a script to remove all core files more than a day or so old from the entire system.

What are we planning to do with these anyway?

Your system should be looked at and set up with a standard set of self help scripts designed to keep it running.

You can not extend the root file system, and should not try. root is a mount point and needs very few actual files on it.

SEP

[subodhbagade]

Hi to all.......

(1)# bdf /
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 262144 256880 5264 98% /

(2)But
du -kx / | sort -rn | head -20
188856 /

and i am finding the difference of 73288 kb , not sure about this memory,,,please help.

(3)ll /core*
/core* not found no core file is find

This specify no core file ....or how to check core file or script

(4)
ll /largedir |sort -rnk5 |head -20
/largedir not found

(5)i had listed the large files
du -kx / | sort -rn | head -20 in my above query

can we move any of listed file or
can we create a seperate mount point (creating new lv ) any one of above...or
can we make soft link of above or how i should i proceed?

waiting for ur valuable reply

Regards,
Subodh

[James R. Ferguson]

Hi:

The descrepency you see between the value 'bdf' reports for used space and the value 'du' reports is due to an open, but unlinked (removed) file.

That is, ther is a process that has opened a temporary file; immediately unlink()ed or removed it; and is continuing to write to the file. This is a standard technique with great value.

You can find the process by looking for a file with a zero link count. The culprit will probably have a large size/offset that more or less matches the difference in used space you see. Do:

# lsof +D / +L1

Regards!

...JRF...

[Dennis Handly]

>(2)But du -kx / => 188856 /
>I am finding the difference of 73288 kb, not sure about this space

If you just rebooted, I'm not sure why there should be this difference. Unless you have files trapped under a mount point.

>(3)ll /core* => /core* not found no core file is find

You need to use find(1) to look deeper:
find / -xdev -type f -name "core*"

>(5)i had listed the large files

These are large directories. You really can't move or symlink them.

You'll need to look inside each of these for large files, or useless logs.
Try: 139872 /etc, 63448 /etc/vx

[Johnson Punniyalingam · Accepted solution]

Hi Subodh,

Have you tried ..? >>Dennis >> suggestions

step1:-
sorted list of all dir and files in /

cd /
du -sk *|sort -krn

Find out large size files:

find . -xdev -type f -size +100000 -exec ls -lrt {} \+

step2:-


vgdisplay -v /dev/vg00 --> output


Thanks,
Johnson

[Paolo Gilli]

Hi, to free some space in root filesystem in short time, try to move the ".old" files in /etc/lvmconf to an other fs.

To extend LVM root Filesystem in HP-UX, read the thrad at http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1098002&admit=109447626+1227255017365+28353475

and the attached file.
"Extending the root file system with Online JFS - fsadm"

hope this help
regard
Paolo