removing files from /var file system

[Shivkumar]

Dear Sirs,

We get alerts from the /var file system getting filled up.
We are thinking remove some depot file from there. I am not sure after installation of patches, can we remove
the depot files from there ? Will it have any impact on the already installed binary ?

Which are directories under /var file system from where we can delete the files ?

Thanks,
Shiv

[Deoncia Grayson_1 · Accepted solution]

you do not want to delete any depots under /var, what you might consider doing is running cleanup -c 1 which commits any patches that has been superseded one time and also check for /var/preserve which sometimes can have huge files and make sure you have a trim script in place that will keep syslogs/mail/cron logs from becomming to large and also monitor the size of wtmp which is located under /var/adm

BTW what is the size of var on your server?

[Andy Torres]

You decide if you want to keep the original depot or not. Take a backup if possible, or copy it to another filesystem with plenty of space. From there you can gzip it, back it up, THEN remove it if it makes you feel more comfortable.

Do a swlist -l depot to see if the depot is a registered depot. If you no longer need the depot, do a swreg -u -l depot /path/to/depot to unregister it.

[Andy Torres]

To be clear, I am not advocating the removal of any software under /var/adm/sw. When I say "original depot" I mean the one you downloaded and installed.

For example, I have a depot I downloaded from HP located under /var/tmp/ANDY/PRM_PATCHES/depot. Once I installed it I verified the installation (swlist -l fileset -a state | grep -v "^#" | grep -v configured). Only then did I comfortably remove /var/tmp/ANDY and unregister the depot.

[James R. Ferguson]

Hi Shiv:

Whatever you do, do NOT manually maintain '/var/adm/sw'. This is your IPD (Installed Product Database) used by 'swinstall' and the other Software Distributer tools.

The safest way to regain space is to run 'cleanup -c 1'. This removes all but one roll-back patch imsage.

If you have "*.depot" files and or patches (PH*_*) in '/var/tmp' then these can be removed when you are done with them, without harm.

Regards!

...JRF...

Regards!

...JRF...

[Justin_132]

Hi Shiv,

Y cant u try a "find" for logs inside your /var before thinking of cleaning up your sw and patches..

Some of your applications can keep old logs files which can be deleted. Even you can search for "core" dumps and touch that..

Just_In

[Geoff Wild]

For cleaning patches:

cleanup -c 1

To check other possibilities:

du -sk /var/* |sort -n

Rgds...Geoff

[Andy Torres]

The cleanup utility is a good idea. You can run it in preview mode first (cleanup -p -c 1) to see what you will gain. If you upgraded to 11.x from 10.x, the -i option can suprise you.

Read the man page on cleanup so you fully understand the weight of committing patches.

I usually start with 'cleanup -p -c 2' and get more brave from there, depending on the server (production/development).

[Rick Garland]

This command may help

# cd /var
# du . -ka -x | sort -nr | more

This du command will list the files in ascending order by sizes.

As previously stated, use cleanup command to reduce the patch database size.

Also look in the /var/adm/syslog. Do you have large syslog.log and/or mail.log files?

Is the crash directory on the same mount point as /var? Do you have crash dumps in there?
You may want to put the /var/adm/crash on its own filesystem.

[Raj D.]

Hi Shiv ,

Check for the big files under /var and you can find some big files or logs.
You can use :
# bdf | grep var # ( check if only var mount point exists).

# cd /var
# ls -lR | sort +4 -5nr | more
( It will show all the biggest files one by one..)



Also check for
/var/adm/syslog/syslog.log
/var/adm/syslog/OLDsyslog.log
/var/adm/syslog/mail.log
/var/adm/wtmp
/var/adm/cron/log

You can nullyfy the files or move to other place to recover free space.


Cheers,
Raj.

[Arunvijai_4]

Shiv, You can use # cleanup -c 1 to clean your depots. Also, look at /var/adm/crash and you can delete unwanted crash dumps. You can delete your old syslog files at /var/adm/syslog dir.

-Arun

[Yogeeraj_1]

hi shiv

i would also recommend that you go through "Routine Tasks" in SAM and purge all your old logs first

this hopefully will clear up a bit of space.

hope this helps too!

kind regards
yogeeraj

[Arunvijai_4]

A good thread worth reading,

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=977812

-Arun

[Shivkumar]

Sirs,

I just ran the command "# cleanup -p -c 2"
and got the below output on test box:-

The following patches superseded at least 2 time(s) can be committed:

Superseded # Times Superseded Disk Space in /var/adm/sw/save Superseded By
========== ================== ============================== =============
PHCO_24813 2 495616 bytes PHCO_26700
PHCO_25082 2 151552 bytes PHCO_26561
PHCO_25311 2 3426304 bytes PHCO_26824
PHCO_25452 3 23476224 bytes PHCO_27434
PHCO_27020 2 571392 bytes PHCO_28259
PHCO_27209 2 385024 bytes PHCO_27243

can anyone explain what this output says ?

[Shivkumar]

also i saw some depot files in the directory /var/opt/patches. should i delete these depot files ?

[Henk Geurts]

you ran a preview for a cleanup which shows you:
the superseded patch
the times its been superseded
the disk space it uses
the patch it has been superseded by.

for the actual cleanup leave the -p out of the command.
regards.

[Henk Geurts]

make sure the are not used (fuser) or registered as depot (swlist -l depot).
if the depot is registered , use :

swreg -u -l depot /var/opt/patches

[Arunvijai_4]

It means, You have installed latest patches and old patches were superseded. You can do that cleanup safely. Also, Check swreg to see that the depots are registered.

-Arun

[Mohan_24]

you can run cleanup -c 1 and remove patches that are superseded at least 1 time.
you may want to run swreg -u -l depot /var/opt/patches to register patches before running the cleanup.