can't delete file

[Alain Tesserot]

There is a file used by syslogd call /vav/adm/syslog/mail.log
I need to delete that file but get an error that the file doesn't exists yet syslogd keeps appending to the file. I really need to delete that file as it is growing and eventually will fill up the file system.
I thought of running fsck -F vxfs -m /dev/rdsk/c0t0d0s0 but are not sure if the -m option will be usefull on a mounted file system.

[RAC_1]

You need to stop processes accessing the file. check those processes.

fuser -u "./file"

Anil

[Rick Garland]

Do not delete this file.

Instead try this;
# cd /var/adm/syslog
# > mail.log

The mail.log file is a log file for the open process of sendmail. Do a rm on this file and you will not get the inodes.

You can >mail.log or do 'cat /dev/null > mail.log' Both do the same thing

Can't find it? What is in the /var/adm/syslog directory?

[Alan Meyer_4]

The processes writing to the file are what is keeping it open and therefore preventing you from actually deleting it. You must find those processes and kill/terminate them. the fuser command will be helpful here.

[Sandman!]

Try zeroing out that file:

# > /var/adm/syslog/mail.log

cheers!!!

[Alan Meyer_4]

there is a log file trimming process available through SAM that might be of help here too...

[harry d brown jr]

get lsof : http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.75/

use "ls -l" and then "lsof" like this (You had a typo of /vav when I think you meant /var):

[root@vpart1 /var/appl]# ls -l /var/adm/syslog/mail.log
-r--r--r-- 1 root root 3907409 Aug 1 16:57 /var/adm/syslog/mail.log


[root@vpart1 /var/appl]# lsof /var/adm/syslog/mail.log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
syslogd 809 root 9u REG 64,0x8 3907409 10494 /var/adm/syslog/mail.log
[root@vpart1 /var/appl]#

and DO NOT DELETE IT, simply truncate it:

cat /dev/null > /var/adm/syslog/mail.log


live free or die
harry d brown jr

[Alain Tesserot]

I can't zero out or delete the file yet syslogd is able to write to that file.
I tried doing an fuser -fu /var/adm/syslog/mail.log but get an error that the file doesn't exist so I can't really tell who besides syslogd is using that file.
I tried stoping syslogd and delete the file but no luck. I'm thinking this either a bug or inode corruption.

[Alan Meyer_4]

You can truncate the file through SAM using the following selections

Routine Tasks
System Log Files

Select /var/adm/syslog/mail.log

then from the "Actions" menu, select "Trim->Trim to Zero"

[Alan Meyer_4]

It ill warn you about active processes having the file open, but select ok and proceed ans the file willbe truncated.

[Sandman!]

What system/OS do you have? If fuser is not showing what processes are using /var/adm/syslog try lsof as suggested by Harry.

Run lsof on the mounted filesystem that contains the "/var/adm/syslog" directory. You can get that info from bdf as follows:

# bdf /var/adm/syslog

now run lsof on the mntpoint returned by the above command...if it's "/var" then run lsof on it like...

# lsof /var | grep -i "/var/adm/syslog"

this will show what processes are using it.

[Rick Garland]

If the file does not exist how do you know that the syslogd is writing to this file? Could it be writing to another file? Somewhere else?

If you have no mail.log file in the /var/adm/syslog directory, try to 'touch mail.log' and watch to see if it is increasing in size.

Maybe the mail.log wasn't there but the syslogd says it is writing somewhere.

[Alain Tesserot]

There is a file /var/adm/syslog/mail.log
If I do ls /var/adm/syslog/ I can see mail.log
If I do touch /var/adm/syslog/mail.log and do ls /var/adm/syslog/ then I see 2 files named mail.log
If I do rm mail.log it removes the one I touched but the original remains and can't be deleted.

I think there may be file system corruption.
Any ideas?

[Dietmar Konermann]

What about unprintable/control characters in the file name? Check this:

ll /var/adm/syslog | vis

If you see something strange there, check also /etc/syslog.conf using vis(1).

Just my 2 cents...
Dietmar.

[RAC_1]

ll | cat -v
ll | vis

There seems to be special char in the file name.

[Alain Tesserot]

No special characters

[Alan Meyer_4]

do an ls -il on the directory to get the inide number of the file and then "find /var/adm/syslog -inum num -exec rm {} \;" to remove the file.

[Sandman!]

Either remove it as suggested by Alan or zero it out:

# find /var/adm/syslog -inum num -exec cat /dev/null > {} \;

[Sandman! · Accepted solution]

You can try removing it interactively by moving into the "/var/adm/syslog" dir and issuing the "rm -i" command:

# cd /var/adm/syslog

# rm -i *mail*

then answer "y" only to the specific file you want removed.

regards!!!

[Alain Tesserot]

Thanks everyone

The solution was to use rm -i *mail*
That got rid of the file and I was able to touch a new one and point syslogd to it.