From just a quick looksee, the following files do *NOT* belong in /:
U474837.tar (30 megs!)
hp-U474837.v11
hp-U474838.v11DCE
s mentioned, 2Gb is *WAY* too large for / as the / directory should be a static volume, perhaps 200 megs i size. What has happened is the previous administrator(s) have allowed massive directories to be created in / rather than on a separate volume (the recommended method). Also, it appears that root's HOME directory is /, a very bad (but very common) problem in many flavors of Unix.
Start by creating a new directory called /root. Then move all files (not directories) to /root. This includes all dot-files (files like .profile and .exrc). Then change root's HOME directory by editing /etc/passwd with the vipw command and change root's HOME from / to /root. The reasom for this is to separate root 'droppings' from the overall root directory and make the root user 1000% less likely to make the terrible mistake of rm -rf * in the wrong directory. You'll also need to move root's local directories to /root:
/.dt /.netscape /.secure /.sw /nsmail
Login again as root (leave an existing session running just in case) and you should find /root as the HOME directory and now look at the files that are there (a lot less than /) to see if there are junk/temp files that can be removed.
As a quick check for /dev, do this:
du -s /dev
It should be just a couple of digits, something like 20 to 50. If this directory is very large (3 digits or more) then someone has likely created an ordinary file in /dev by misspelling a device file. Do this:
find /dev -type f
Remove all ordinary files that you see in this find search. Common mistakes are: /dev/rmt/om (supposed to be /dev/rmt/0m) and /dev/null1 or /dev/null2, etc.
Now it is time to locate all the directories that are part of / and not separately mounted volumes:
du -kx / | sort -rn | head -20
The *only* occupied directories in / should be:
/sbin
/etc
/dev
Nothing else!
From the above list, the previous admin(s) used root's HOME as a junk storage area (see the directories /MQHA /archive /hponly /jag /nixon /oradata) so these (probably very large) directories must be moved. It is hard to tell if any of these directories are critically important to your system's operation. NONE of these directories have anything to do with HP-UX so you can move them to another volume but I would do this during downtime if this is a production system. Then startup your usual applications (looks like Oracle and MQM) so see if all is well.
As a general rule, / is a static directory and never grows except when the root user makes a mistake. Often the mistake is allowing 3rd party software to self-install without any controls. A lot of 3rd party (and freeware) software never asks the sysadmin where the files should be installed. Like most modern SysV (layout v.4) systems, /opt is the preferred location for applications, with /usr/local and /usr/contrib less desirable.
Note also that your system needs a security review. There are several 777 directories in / (a terrible security error) such as /MQHA /archive /hponly /nixon and I suspect the the permissions of the directories in /usr/local are also 777 (actually an HP-UX installation error). All directories should be 755, just like /usr/contrib. This will fix /usr/local:
find /usr/local -type d -print -exec chmod 755 {} \;
I also see a /core file iwhich means that there may be many more scattered around the system. If you do not write, compile and test your own software, you should determine what programs caused the core file then remove them after asking the program's author for a fix. This will help locate core files:
find / -type f -name core -print -exec file {} \;
Note that this will keep HP-UX pretty busy for a fe minutes so run the command during quiet time.
Bill Hassell, sysadmin
