/var is full

[Gibddnsk]

Hello everybody!

I delete old logs and have 3gb free space on /var. But in some days /var again full!!!

I read all about /var here.

I used cleanup, delete all old logs, cp /dev/null /var/adm/wtmp, and wtmps, btmps... and i have about 200megs of free space, but!!!

after 1-2 minutes /var again was full!! I have no idea why its happens and what to do. Please help!

Sorry for my english...

[Dennis Handly]

Have you used lsof to find deleted files?

[Gibddnsk]

No, i've not. I do not understand why i must find deleted files?

[Dennis Handly]

>I do not understand why I must find deleted files?

You said it gets full after a few minutes.  If this is not the logs and wtmps that you just removed, it could only be someone still writing to a deleted file.

[Bill Hassell · Accepted solution]

Deleting log files is not always a good idea. If the files are large but you don't need the information, then truncate the files with either:

cat /dev/null > /var/adm/something.log 
or
 > /var/adm/something.log

so as to preserve the permission and ownership. If you simply delete a file -- and the file is still open -- the file will disappear from the directory but the space will not be returned. The process(es) keeping the file open must terminate before the space will be returned. Truncating the file reduces the size immediately. Since you deleted active logfiles, they are still growing but you cannot see them -- the name has been removed from the directory. Only a reboot will fix this. And when you have large log files, never delete or truncate them until you look at the most recent messages. You may have a critical disk or memory failure that must be resolved.

In general, start by finding the large directories (not files!). Use this command:

du -kx /var | sort -rn | head -20

 which will sort all the directories by size, largest at the top. Then look inside the directory to see what is using all the space. DO NOT delete anything in /var/adm/sw! Use the cleanup command.

[Gibddnsk]

Thanks to all! The problem is solved by rebooting servers.

And you know what? I'm happy!)))

[Bill Hassell]

And to explain why a reboot fixed the problem, a process was probably creating a large file which you deleted. But as mentioned, the name disappears from the directory so you can't see it but until the process is terminated, the file is still there, continuing to grow. The reboot killed the process, and the space was reclaimed.