Cleaning /var

[C_V]

Hey guys in /var what are the logs here that can be trimmed/trancute or delete without making anyone angry and what are the logs that should not be touched?

[Khairy · Accepted solution]

hi,

use cleanup utility to trim /var/adm/save patches. It good to start with option 1 as it will allow u to rollback any patches.

# cleanup -c 1

Other than that, try the conventional way,

# du -sk /var/*

rgds

ps: really appreciate if u could assign some points.

[Khairy]

you could also look for old core files in /var. You could safely remove this.

do the following to look for large files in /var

# find /var -size 100000c -print

[Jeeshan]

mostly you can see the /var/adm/syslog folder

trim or backup the existing OLDsyslog.log file and restart the syslog daemon. it will move to OLDsyslog.log and syslog.log file would be starting from scratch.

and also you can trim any other log in that folder.

but before that you can take a backup or zip that particular file.

[Niceguy_2]

Hi,

You can use this commands to find the 1MB file /var
find /var -size +1000000c -exec ll {} \;

You can check for /var/adm/crash and remove the crash file if generated

[C_V]

Tnx guys, how about the /var/spool what is use of this directory, does it contain critical files.

[Dennis Handly]

>how about the /var/spool what is use of this directory, does it contain critical files?

It contains at & cronjobs and undelivered mail.

[Johnson Punniyalingam]

>>how about the /var/spool what is use of this directory, does it contain critical files.<<

/var/spool
This directory contains temporary spool files used in printer spooling, mail delivery, cron(1M), and other commands.

>>does it contain critical files.<<

YES.

could also please let us know are going to cleanup some files under /var/spool ..?

Thanks,
Johnson

[Bill Hassell]

For any directory, the starting point is to look for the largest directories first:

du -kx /var | sort -rn | head

Then look at the largest directories. Large files may not be the problem...there may be hundreds of small files that can be removed.

As far as making anyone angry, the /var directory is like any other directory. A normal user cannot create any files in most of /var except /var/tmp. That is a directory that users must treat as temporary, but I would contact users with large files in /var/tmp before removing them. Let them know the rules such as: all files in /var/tmp older than 7 days will be automatically removed (or something similar). /tmp is the other directory that needs similar monitoring.

[Kapil Jha]

first of all do a bdf and check if /vad/adm/sw is different file system.

#bdf|grep var

before running cleanup -c 1
take ignite because u wont be able to recover the system after that.

and do
#du -sk *|sort -n and check the directoreis.

Thanks
Kapil+

[Mark McDonald_2]

Does the box host an application that is logging in to /var? I quite often have problems with app teams filling up file systems especially on the development boxes.

[Sagar Sirdesai]

Hi
Normally /var also get filled with wtpm* files.

You also trin thse files.

Sagar

[C_V]

So guys eventually the contents of /var/spool files will be automatically removed once the printing has been done or the mail has been sent?

[Dennis Handly]

>eventually the contents of /var/spool files will be automatically removed once the printing has been done or the mail has been sent?

The keyword is eventually. If mail can't be sent, the mail may just sit there.

[Suraj K Sankari]

Hi,

Under /var you can trim all log files.
wtmp
btmp

just give > and filename it will trim the file ex:

>wtmp or >btmp

or you can find big file under /var

cd /
find /var -size +100000 -print

Suraj