Cannot find what is fiiling "/var"

[R.O.]

Hi,

I have this strange situation:

Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol8 4718592 4682856 35736 99% /var

system1:/var (root) #du -sk .
519096 .
system1:/var (root) #du -sk *
0 X11
353520 adm
408 asx
8 dbforabackup
40 dt
0 home
0 ifor
0 jail
0 lost+found
816 mail
0 mysql
0 news
0 obam
148296 opt
0 parmgr
0 preserve
0 rap
0 rbootd
16 run
560 sam
112 spool
8 statmon
15048 stm
72 tmp
8 tombstones
0 uucp
80 vx
96 yp

Does anybody know what is happening?? I have tried to "find" large files or to find directories with many files under "/var" but i cannot see nothing...

Regards,

[Luk Vandenbussche]

Hi,

I might be a good idea to trim logfiles under
/var/adm.

Look under this directory for large files

[R.O.]

There is no large files; as you can see, in /var/adm there is about 350 Mb of data. In fact the bdf shows more than 4 gb occupied and "du" shows only 519 Mb of space occupied in "/var". That is what I do not understand.

Regards,

[Brett Williams · Accepted solution]

Perform the following command to identify what processes have open files under /var:
fuser /dev/vg00/lvol8

More than likely, one of those processes has an open file that has filled up the file system. Something may have removed the file from the view of du and ls but has left an open inode to that file system and the processes still has it open and in turn the bdf commmand reflects the full file system.

Once that processes has died then file system should return to normal.

A recursive fuser command against the individual files under /var cross-reference with the fuser against the lvol should provide you with the processes in question.

[A. Clay Stephenson]

You have a fair amount of data under /var/adm. That could be old patches which can be cleaned up via the "cleanup -c 1" command which will leave 1 prior version should you need to back out a given patch. If you are running NNM, OV/O, and/or DP (or other OpenView products) then /var/opt will have tons of data. It is a good idea to move /var/opt/OV and /var/opt/omni to other filesystems as well as /var/adm/sw.

[Tom Ward_1]

Hello R.O.

It sounds as if someone deleted a file that was in use. That will remove the file, but not release the space until the process using the file is stopped. I'd suggest you try cycling syslogd. If others have root access check with your peers and find out if someone deleted a file without checking for an active process on the file.

Regards,
Tom

[R.O.]

I have already tried the "cleanup" command, in preview mode, but it only frees about 500 kb.

Regards,

[R.O.]

Finally, I have rebooted the system (450 days up) and this is the result:

Filesystem kbytes used avail
/dev/vg00/lvol8 4718592 525800 4160376 11% /var

So, Brett and Tom, you are right !! Many thanks to all for your help !!

Regards,

[R.O.]

See previous posts !

[Sorrel G. Jakins]

Sounds like you need to run lsof, which is the utility I use when I want to know which 'deleted' but still 'open' file is holding all the space.