managing /var area

[Nago]

Suddenly my /var area is 100% full. what files do I delete to create space again. every file i see appears critical. Kindly assist to enable me proceed with work. Thanks a lot people.

[Jean-Luc Oudart]

Check /var/tmp , you may have old/unwanted files. temporary files should be checked with the fuser command before you delete them.
also
> btmp
> wtmp
if you don't want to keep last logins , bad logins (you can still copy the files elsewhere before you reset them)

Same idea for the log files.

But this may not help you if you have a process writing mad in /var.
detect the process and check what its behaviour !

Last resort, your /var was too small andyou readch 100% today. Therefore you need to expand /var.
plenty of threads on the subject.

Jean-Luc

[Ravi_8]

Hi,

if all the present files are critical, then you have to increase the /var filesyetm size

[Chris Wilshaw]

Check the contents of /var/tmp and /var/adm/syslog

Beware of deleting files in these areas, as if a process has them open, you will not reclaim the space until the process completes/is killed.

better to use

> filename

to truncate the size to 0, but make absolutely sure that nobody needs the file(s) before doing this.

[James R. Ferguson]

Hi Nago:

There are several places to look for files to remove in '/var':

If you have old crash (memory) dumps in '/var/adm/crash' taht have been analyzed, then remove them.

Old 'vi' editor recovery files reside in 'var/preserve'. You can remove old ones, appropriately.

Look for 'core' files and remove with:

# find /var -name core -exec rm -i {} \;

Use 'cleanup' to trim old SD (software distributer) logs and commit patches. Do *NOT* manually diddle with the 'var/adm/sw' directory!!! :

# cleanup -c 1 #...for 11.x
# cleanup #...for 10.20

Files in '/var/tmp' are candiates for removal.

Look for directories with large sizes:

# du -kx /var|sort -rn|more

Regards!

...JRF...

[harry d brown jr]

start with finding large files:

find /var -type f -size +1000000c -exec ls -l {} \;

download and install "lsof"

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.64/

and use lsof to make sure no process has the file opened before removing or gzip'ing it.

also find sub-directories of /var that might be an issue:

du -sk /var/* | sort -rn | more

live free or die
harry

[Nago]

Thanks a lot people. In my troubleshooting exercise, I realized a user aborted a backup process and as such an index file was created in /var/sam/log area. I just deleted the file and i got enough space now. Thanks and bye

[Chris Fadrowski]

you can also eliminate tombstones. Just keep ts99.

[Sanjay_6]

Hi,

you can cleanup /var/adm/crash if not required. /var/adm/sa could be cleaned up except the current file. Also look for log files under /var/stm/logs/os, /var/tmp, /var/opt/perf/datafiles.

Hope this helps.

Regds

[Anil C. Sedha]

Nago,

Follow these steps to create space in /var

1) Check for /var/adm/crash directory. If this is not a seperate filesystem (ideally it should be equal to your installed memory space and mounted as seperate FS) then your /var directory may lose a lot of space. Clear up the directories listed within this.

2) Do a "du -sk /var/*"
This will give you a listing of which directory is using a high amount of space. Check your /var/adm/syslog directory. If you feel the log size is too big clear the log file and create a new one with the same name. Whatever space you get in such times, is always essential space.

3) Verify your application log directories under /var
Mostly all application log files are placed under /var

You may move into each application directory under /var if they are not mounted as seperate filesystems and clear the log files.

4) Run "top" command and see if any process is going haywire and creating problems utilizing large CPU or memory. If that's the case, kill the process with the process id shown in TOP and you should be good to go.

Enjoy,
Anil
(Don't forget to assign points if you find answers valuable. Many people have helped you here"

[radi_1]

Hi Nago,
If all the above do not work,simply reboot the system.By all means you have to reboot because if /var is full you can not print,edit files or even use sam.
Regards