Housekeeping /var

[Shahril M]

Hi,

As I await my next maintenance window to increase the space for /var, I wish to perform some housekeeping.

Doing a du gives me the flwg top 10:

704772 /var
452983 /var/adm
254703 /var/adm/sw
236085 /var/adm/sw/save
127493 /var/stm
113296 /var/stm/logs
113043 /var/stm/logs/os
94457 /var/opt
88689 /var/adm/syslog
62843 /var/opt/perf
62144 /var/adm/syslog/bkup
61861 /var/opt/perf/datafiles

In /var/stm/logs/os, I see a number of log.raw which dates back to 10 days ago.
Can these be removed?

Also, the biggest file is log1.fmt5. What is this file for?

Appreciate all responses, TIA.

Rgds,
Shahril

[Patrick Wallek]

I'd look at the cleanup command to clean up your /var/adm/sw and /var/adm/sw/save area. It should be installed on your machine, so 'man cleanup' will give you full details.

[John Poff]

Hi,

You might be able to go into stm or xstm and find a place to cleanup the logs, but I'm not sure.

I'm with Patrick, try the cleanup command.

JP

P.S. Patrick, come to the chat room, dude.

[Shahril M]

Hi Patrick/John,

My colleague had advised, based on an HP engineer's recommendation, not to remove superceded patches unless critically necessary.

Thus, for now, I would like to focus on the stm logs.

Any advice on those files?


Rgds,
Shahril

[S.K. Chan]

To answer your question, yes they can be removed (only the old files0. The latest chassis log file is named log1.raw.cur (if I'm not mistaken), do not remove that file. Basically any file with the .cur extension is best left alone. If you can afford it you may want to recycle some of the system log files like ..
/var/adm/syslog/syslog.log
/var/sam/log/samlog
/var/adm/lp/log
/var/adm/cron/log
/var/adm/sw/*.log
There may be more (I can't remember). Also take a look in /var/adm/crash
to see any files are there (eg: core.*). These can also be removed (assuming you've view them). A few other tips I can think of are ..
- look for core files
# find /var -type f -exec ll {} \;
- look for individual big files that may be accidently placed in /var
# find /var -type f -size +500000c -exec ll {} \;
==> files bigger than 500MB
Delete them if they are not suppose to be there. Lastly you may want to consider getting OnlineJFs installed so that the FS can be increased on the fly, which makes admin job much easier.

[Shahril M]

Thanx S.K.

Now, I have the flwg in /var/opt/perf/datafiles:

-rw-rw-rw- 1 root sys 19692420 Apr 19 14:12 logproc
-rw-rw-rw- 1 root sys 9663724 Apr 19 14:10 logtran
-rw-rw-rw- 1 root sys 10107260 Apr 19 14:10 logdev
-rw-rw-rw- 1 root sys 9786600 Apr 19 14:10 logappl
-rw-rw-rw- 1 root sys 8291642 Apr 19 14:10 logglob

What can I do with these?


Rgds,
Shahril

[Michael Steele_2]

'logglob' et al., are use by measureware for heuristical data analysis. This is the raw binary format. 'extract' and 'perfview' are used to convert into ascii.

Note that standard log files can also be trimmed using SAM as follows:

sam -> Routine Tasks -> System Log Files -> highlight /var/adm/cron/log -> Actions -> Trim

For example.

[Rita C Workman]

Hmm....I going to go along with Patrick here.

It is safer to clean up using the cleanup utility (to get rid of old patches)
To cleanup /var/tmp of old garbage.
To cleanup old logfiles by using SAM/Routine Tasks and trim files.
To cleanup /var/preserve of old garbage.
Check for old core files and remove them.
* * You might check for other software dropping old logfiles under /var and cleanup or trim them.


Now if you issue is increasing /var and waiting for a 'window'...I might ask if you have Online JFS on your server. Because if you do than you can increase /var online, thus avoiding any downtime. If you don't have this software, then maybe you might check into purchasing it . You can tell mgt that it pays for itself, with the elimination of alot of downtime in these types of situations.

Just a thought,
Rita

[Steven E. Protter]

Looks like you've been backing up log files.

Quick tips:

cleanup -1

That will remove any patches that have been superseded more than once, but this means you can't go back to them.

That saves a ton of space on a heavily patches system.

Another quickie is to go into sam and trim logs. You can set reasonable sizes, or just trim them down to recommended sizes.

It does appear that you've got a cron script running thats backing up logs which would be great if you had the space. You might want to clear the log once a week and not keep backups until you increased /var

Just a note: If you are not licenses for Online JFS, you'll need to expand your /var filesystem in single user mode.

Booting the box, interupt at the 10 second prompt, bo pri Y interact with the ipl

hpux -is

Single user mode. Now you can expand /var using normal lv commands.

SEP

[Geoff Wild]

Just a tip, we use measure ware/perf view at our site and what we do is create a seperate filesystem for /var/opt/perf/datafiles - that way it doesn't interfere with /var.

Rgds...Geoff

[Tim Sanko]

I offload my /var/adm/sw/save to a different drive, and put a link to it in /var/adm/sw.

I do the same things with
/var/stm/logs.

It merely saves storage on the partition.

[John Payne_2]

You are afraid to use cleanup?

How do you patch, reactively or proactively? Do you use the quality pack?

I have never had to remove a patch from a server. I use the Quality Pack bundles. When have you had to back off a patch. I once talked to a guy that had /var at 4GB, and had never ever deleted a patch. It filled up and he didn't know what to do. The answer is to clean up your patches. If you don't like doing a cleanup -1, do a cleanup -2. If you have never done it, you are bound to save some space....

Hope it helps

John