making space in /var

[Paul Wright]

I'm trying to make more space in /var. I noticed in /var/adm/crash, there are several directories (crash.0, crash.1 etc) with dates ranging back as much as 2 years that are reasonably large. Do I need to keep all these directories or can I delete all but the most recent?

Thanks in advance
Paul

[Steven E. Protter · Accepted solution]

You can erase the directories in /var/adm/crash without ill effect.


You might want to copy them somewhere first and run crash dump analysis on them first. You might have a problem with your system. If they are old and your system is stable, erase without worries.


Attaching some instructions on how to do q4 analysis.

SEP

[Jeff Schussele]

Hi Paul,

Those are old crash dumps.
If they don't need to be analyzed anymore, they can be removed.

Rgds,
Jeff

[Patrick Wallek]

If those crash dirs are 2 years old, and not from any recent crashes, then yes you probably can get rid of them.

The other thing you can do to try and free up space in /var is to utilize the 'cleanup' utility to commit patches. That can free up a whole lot of space. Do a 'man cleanup' for more information.

[Brian Bergstrand]

The crash logs are kernel core dumps from panics. If the issue is resolved, then you delete all of them. If you are still having problems I'd keep the two or three most recent incase HP wants/needs them.

Also, on 11.x (with patches) you can run 'cleanup -c N' (where N is 1 or 2) to free up some space taken up by patch archives.

HTH.

[Sundar_7]

They are crash dumps saved by the system upon panic.

Since they are very old, you are safe to delete and free up the space.

Also look at log files in /var, they tend to grow witout bounds :-)

du -sk /var | sort -n

[James Specht]

If you have no need for the information from the crash, kernel panic, then yes you can delete them.

--Jim

[TC ITEMS Unix Admin]

Hi Paul:
A couple of things you can do:
1. If you have never done crash analysis on your crash files in two years, its safe to say they can go.
2. Try and find out why your /var is growing and plan for growth.
3. If you have onlineJFS installed, you can extend the filesystem on the fly
4. You can create another mount point for say /var/adm/sw (for software installs), move all your files from your existing /var/adm/sw to this mount point, and then include the mount point in your /etc/fstab. You can do this on the fly as well.
5. If you can schedule a reboot of the server, then you can either use the ignite procedure to rebuild the server/filesystems or you can just go into single user mode and extend the filesystem.

Good luck

[Robert-Jan Goossens]

Hi Paul,

How about removing superseded patches in /var with the cleanup utility.

# cleanup -p -c1

Robert-Jan.

[GK_5]

Paul,

You can delete those old crash directories. Also you can trim system log files through SAM - routine tasks.
Also you can run cleanup utility which removes older versions of patches. Man cleanup for more details.

-GK-