how to use "ls" to search the biggest files in /var?

[thebeatlesguru]

how can i do that?
find the biggest files in /var?

[Patrick Wallek · Accepted solution]

# ls -l | sort +4nr

will show largest files first

# ls -l | sort +4n

will show largest files last

If you want the whole /var directory structure use 'ls -lR' in the above command lines.

It would probably be easier to use du to do this though.

# du -k * | sort

should get you something close to what you want.

[Rajeev Shukla]

Hi use find command instead.
syntax...
find /var -size +1000000c -exec ll {} \;

this will list all files greated than 1MB.
For more information do man on find command.

Cheers
Rajeev

[Patrick Wallek]

A correction to my last post.

The syntax for the du command with sort is:

# du -k * | sort -n
Will sort smallest to largest

# du -k * | sort -nr
Will sort largest to smallest

[T G Manikandan]

Do a
#du -k /var|sort -nr
This will list the greater MB size in descending order.

WHat you can check is for
check for these dir

/var/adm/crash
/var/tombstones
/var/adm/syslog/
/var/mail
/var/adm/wtmp

/var/opt/ignite

ALso you can clean the /var/tmp
remove the files which were not accessed for the past 7 days
find /var/tmp -atime +7 -exec rm {} \;

REmove the unrequired files and clean the file system.

[Bill Hassell]

Be careful in looking for big files. Quite often, a programming mistake will leave thousands of small files that will be missed by the find command (looking for 1meg or larger). /var s the busiest filesystem in HP-UX and MUST be actively managed, that is, logfiles and temp files must be trimmed.

As mentioned, du -k is the preferred command because it shows the biggest directories. Once you see the biggest directories, look inside the directory and sort files by size using:

ll | sort -rnk5 | more

Files that will grow very large are logfiles in /var/adm and also /var/adm/sw where patches and other rollback files are stored. /var/adm/sw is always a candidate for a separate volume.

[Yogeeraj_1]

hi,

concerning du:

i prefer to use the -s option which allows me to print only the grand total of disk usage for each of the specified name operands.

E.g.
# du -sk /var/*
0 /var/X11
282551 /var/adm
20 /var/dt
0 /var/lost+found
255 /var/mail
0 /var/news
55453 /var/opt
1441 /var/preserve
0 /var/rap
0 /var/rbootd
2 /var/run
23428 /var/sam
403 /var/spool
2 /var/statmon
15106 /var/stm
17714 /var/tmp
402 /var/tombstones
0 /var/uucp
40 /var/yp
#

Then i drill down the directories in search for any suspicious files.

Please note that in SAM->Routine Tasks you already have a list of selected OS logfiles that alleviates the logfile trimming tasks of SysAdmins.

Cheers
Yogeeraj

[thebeatlesguru]

i found these are a lot of big files in /var/stm/logs/os
*.raw files

[Yogeeraj_1]

hi again,

Before you delete any raw logfile file, you must find out WHY its got so big! Each file is written to every time a significant hardware event occurrs, so it could be some component on your system is failing.

Before deleting any file, you should first tell STM to start using a new log.

Please see the following post:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x20e191ccb36bd611abdb0090277a778c,00.html
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x5b3d7b8d1de3d5118ff40090279cd0f9,00.html

Cheers
Yogeeraj

[Fragon]

For safty reason,you should not delete these files directly instead of empty them. Normally we use
#> logfile
to empty the log file.

[T G Manikandan]

Do not delete the two files in the /var/stm/logs/os

logN.raw.cur
memlog
memlog is used for memory logging.
logN.raw.cur is the current log file for stm.

However you can delete the other old log files provided you will miss the old data.

check this link on the stm logging.

http://www.docs.hp.com/cgi-bin/otsearch/getfile?id=/hpux/onlinedocs/diag/logtool/log_data.htm&searchterms=/var/stm/logs/os&queryid=20020218-001728

Revert

[Fred Martin_1]

I have a script called "biggest" which contains the following single line:

ls -l | awk '{printf("%10s:%s\n",$5,$0)}' | sort | cut -c12-

In my case, I 'cd' to a directory and run 'biggest' ... it displays the biggest files with formatted output.

If you wanted something that would traverse directories, you could use this as a starting point.

Fred

[Steven E. Protter]

A useful 10 point script(hint hint) that you can modify for your own use.