HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
cancel
Showing results for 
Search instead for 
Did you mean: 

/var is full

 
SOLVED
Go to solution
Gibddnsk
Regular Visitor

/var is full

Hello everybody!

I delete old logs and have 3gb free space on /var. But in some days /var again full!!!

I read all about /var here.

I used cleanup, delete all old logs, cp /dev/null /var/adm/wtmp, and wtmps, btmps... and i have about 200megs of free space, but!!!

after 1-2 minutes /var again was full!! I have no idea why its happens and what to do. Please help!

Sorry for my english...

 

Alnaz
6 REPLIES

Re: /var is full

Have you used lsof to find deleted files?

Gibddnsk
Regular Visitor

Re: /var is full

No, i've not. I do not understand why i must find deleted files?

Alnaz

Re: /var is full

>I do not understand why I must find deleted files?

 

You said it gets full after a few minutes.  If this is not the logs and wtmps that you just removed, it could only be someone still writing to a deleted file.

Bill Hassell
Honored Contributor
Solution

Re: /var is full

Deleting log files is not always a good idea. If the files are large but you don't need the information, then truncate the files with either:

cat /dev/null > /var/adm/something.log 
or
 > /var/adm/something.log

so as to preserve the permission and ownership. If you simply delete a file -- and the file is still open -- the file will disappear from the directory but the space will not be returned. The process(es) keeping the file open must terminate before the space will be returned. Truncating the file reduces the size immediately. Since you deleted active logfiles, they are still growing but you cannot see them -- the name has been removed from the directory. Only a reboot will fix this. And when you have large log files, never delete or truncate them until you look at the most recent messages. You may have a critical disk or memory failure that must be resolved.

 

In general, start by finding the large directories (not files!). Use this command:

du -kx /var | sort -rn | head -20

 which will sort all the directories by size, largest at the top. Then look inside the directory to see what is using all the space. DO NOT delete anything in /var/adm/sw! Use the cleanup command.

 



Bill Hassell, sysadmin
Gibddnsk
Regular Visitor

Re: /var is full

Thanks to all! The problem is solved by rebooting servers.

And you know what? I'm happy!)))

Alnaz
Bill Hassell
Honored Contributor

Re: /var is full

And to explain why a reboot fixed the problem, a process was probably creating a large file which you deleted. But as mentioned, the name disappears from the directory so you can't see it but until the process is terminated, the file is still there, continuing to grow. The reboot killed the process, and the space was reclaimed.



Bill Hassell, sysadmin