There are two things to accomplish. First, log all dmesg lines to a file with a timestamp. An example for a cron job entry is found in /usr/newconfig/var/spool/cron/crontab.root which reads (in part):
# log kernel diagnostic messages every 10 minutes
05,15,25,35,45,55 * * * * /usr/sbin/dmesg - >>/var/adm/messages
I don't agree with the suggested name for this file (messages) so I would recommend changing it to:
# log kernel diagnostic messages every 10 minutes
05,15,25,35,45,55 * * * * /usr/sbin/dmesg - >>/var/adm/dmesg.log
Add this to your root cronjobs (you should many to trim logs, watch for disk space problems, run backups, etc). Now, when you want to see what dmesg is reporting, use the command:
tail -50 /var/adm/dmesg.log
dmesg is a program that reads an in-core buffer of console messages and as such, it cannot be cleared. Once the buffere is full, old messages are dropped off and new ones are added at the bottom.
As as the reason for /tmp becoming full, this will take some work. /tmp is (and must always be) open to every user on the system. Less experienced Unix users and sysadmins will store all sorts of junk files in /tmp and then forget to remove them.
The correct directory is /var/tmp but since scripts and programs misuse the /tmp directory, you'll have to run a cronjob to clean out old files automatically. The also applies to /var/tmp. A good rule of thumb is to remove any file and directory in temp directories that is more than a week old. And for real problems, very large files (more than 3 to 5 megs) should be removed after 3 days.
To see how your /tmp area is being used, use the command:
du -kx /tmp | sort -rn | more
The largest directory (below /tmp) will be shown. If this is not very big (3 digits or less) then /tmp may have one or more large files. To see the files sorted by size, use the command:
ls -l | sort -rnk5
The owner of the files and directories will be shown but the programs that caused the program will not be determined.
Bill Hassell, sysadmin
