/root fs full

[mavrick]

my /root file system is full. I wnat to compress my log files . shall i do gzip for my syslog.log . after that how can i create my syslog.log file..?

thanks in advance

[Court Campbell]

usually /var is it's own file system. So compressing the logs there will not help clean up /.

[Geoff Wild]

Your syslog.log shouldn't be in / - should be in /var

from / do a:

du -sk * |sort -n

Then ignore any mounted filesystems to find what is taking up space.

Is there a /core file? That could be taking space...

Rgds...Geoff

[Ludovic Derlyn]

hi

syslog is not under /root? it's lmust be under /var

If need to recreate execute a "touch syslog.log" for example

if / is really full, search after file core for example

Regards
L-DERLYN

[James R. Ferguson]

Hi:

Your 'syslog' file should reside in '/var' not '/'.

If '/' is full, look for regular files in '/dev' that don't belong. The most common mistake is a mis-spelled device file like '/dev/rmt/om'.

# du -xk /|sort -k1nr|more

...will show you in descending order the largest to smallest directories.

If archiving and beginning with an empty 'syslog' is the issue, one way is to do:

# /sbin/init.d/syslogd stop
# /sbin/init.d/syslogd start

This will create '/var/adm/syslog/OLDsyslog.
log' which you can then compress. A new, empty copy of 'syslog.log' will exist, too.

Regards!

...JRF...

[Oviwan]

seach for huge files under /root

10 largest directories
$ du -kx /root | sort -rn -k1 | head -n 10

10 largest files
$ find /root -type f -xdev -print | xargs -e ll | sort -rn -k5 | head -n 10

Regards

[Srinivas Thokala_1]

cp or mv syslog.log file to other filesystem
/sbin/init.d/syslogd stop
cat /dev/null > syslog.log
This will recreate this file with zero size.
restart syslogd
/sbin/init.d/syslogd start.

or identify the large files in directories with command.
du -k |sort -rn |more
or find / -size +5000 -print
and manually clean them up.

-Srinivas

[Srinivas Thokala_1]

If root fills up, first check for a large core under root or /etc.
Another simple way to find out what is filling up root is to run the following find, then view the output.
Cd /
Find . -xdev -print -exec ls -ld {} |; >/tmp/rootlist
This will list all of the dirs and files under root and their sizes. There should be NO application files is this list.

The other way is run:
# du -akx | sort -nr | more

-Srinivas

[Ralf Seefeldt]

Hello maverick,

if you want to compress active logfiles like syslog, /etc/wtmp /etc/btmp, you have either ti restart the services which write to this files afterwards, or you may just clear them as follows:

gzip -c file > file.gz
> file

The 2nd line overwrites the file with nothing, reducing the size to 0 bytes while not touching the adress of the file; i.e. The syslogdaemon still can find its present syslogfile thereafter.

Bye
Ralf

[V. Nyga]

Hi,

I'm just wondering - compress the files will not work if the file system is REALLY full!
When compressing, a additional file will be created till compression is completed - then the old file will be deleted.
And a 'bdf' would be interesting, to see which directories are under /.

Volkmar

[Dennis Handly]

>Volkmar: I'm just wondering - compress the files will not work if the file system is REALLY full!

I guess you would have to copy the file to another filesystem. Or use stdin:
$ cd filesystem-with-space
$ gzip < /root-fs/big-hog > big-hog.gz

[V. Nyga]

@Dennis

right!

:-)