/var/adm/crash

[Sandile]

hi all

Anyone can help me on my unix system I get the above directory full of files that I dont neet on my system and I do not want that directory to grow.When this directory grows all the application processes stops cause the /var dir will be 100% after that.I want to maybe suspend or remove the contents of this directory. Or any other suggestions ?

[melvyn burnard]

well if you have a load of files in /var/adm/crash, how old are they?
This is the default directory for system panic dumps.
If you do not want a dump analyzed, just remove files.

[John Dvorchak · Accepted solution]

The easiest way to get rid of unwanted files is to not put them there in the first place. If they are application or users logs, files etc. create a new file system for them and mount them at the same path in /var.

If they are system or your files then you could try a cleanup script that deletes old files. Be careful no to delete just any old file. You have to be specific. Lets say you have some logfiles in the /var/adm/whaterver directory then a script like:

find /var/adm/whatever -type f -mtime +14 -exec rm {} \;

That would find all files of type file older than 14 days old and remove them. Once again be careful not to remove things like /var/adm/syslog files.

Good luck

[Sunil Sharma_1]

Hi,
If you have any case open with HP for Support then these files may be required by HP to analising the root cause of problem otherwise you can delete these files.

You can write some small script to delete files in this directory and make habit to keep a copy of latest crash it may help..

Sunil

[Norman_21]

Hi,

Just my $.02.
I would go into the configuration file /etc/rc.config.d/savecrash and change the default directory to a different than /var/adm/crash to avoid file system full when the system crash in the future. Alos, the best way for now is move those files or perhaps copy them into a tape and then remove them from the system.

Hope this help.
Thanks and good luck.

[Radhakrishnan Venkatara]

hi,
I use this script to monitor my filesystems when it is growing beyond 90% it will issue me the warning. u can set it to according to ur requirements.this
script is scheduled in cron and it runs periodically and if it founds , it sends me a mail.
u can customize according to ur requirements.

the script
#! /bin/sh
bdf | grep -iv filesystem | awk '{ print $6" "$5}' | while read LINE; do
PERC=`echo $LINE | cut -d"%" -f1 | awk '{ print $2 }'`
if [ $PERC -gt 90 ]; then
echo "${PERC}% ALERT" | mailx -s "${LINE} on `hostname` is almost full" mail@user.com
fi
done


thanks

radhakrishnan

[Bill Hassell]

There won't be any files in /var/adm/crash unless your system crashes. If this is happening frequently, your system is seriously in need of patches. A simple workaround is to simply remove the /var/adm/crash directory. If it is missing, when the system recovers from a crash, no files will be created since the directory is missing. System crashes are a serious problem and should be addressed as soon as possible.

[Kent Ostby]

Sandile -- Given that crash dump files are needed to troubleshoot most system crashes, an alternative to deleting the directory is to redirect crash files to another filesystem.

In the file /etc/rc.config.d/savecrash, you can uncomment and set the parameter, "SAVECRASH_DIR".

This will allow you to redirect future system crash files to a directory of your choosing on a file system with more available space.

If you have any recent crash dumps, I would recommend opening a call with HP to have them looked at in order to prevent future failures.

While patching is a good idea, crashes can have many root causes and should be troubleshot by an expert.

Best regards,

Kent M. Ostby

[Steven E. Protter]

If its core files in /var/adm/crash

You might want to find out WHY the crash is happening.

Run q4 analysis on the files prior to deleteing them all.

DO NOT remove /var/adm/crash directory without redirecting the little buggers someplace else as noted in the above posts.

I do recomend following the attached cheat sheet and figuring out why the dumps.

SEP

[Geoff Wild]

Our standard is to have a seperate file system for /var/adm/crash = to system ram + 2GB.

That way you don't need to worry about /var filling up.

Do, however, find out why you have crash files in /var/adm/crash


Rgds...Geoff

[Sandile]

This seems as if its a bit filling up slowly now. I made that directory empty. I did not remove it.Its there but it is an empty directory.

Thanks to you guys for you commitment.
Sandile

Points Assigned

[Geoff Wild]

Just a friendly reminder that the points didn't get assigned. :)

No points for this post please.

Thanks...Geoff

[Kelli Ward]

Hi,
If you emptied /var/adm/crash and it is beginning to fill again, there is likely an issue that needs to be addressed.
If you are running 11, check out EMS.
You can also load and run STM (if not loaded) and see if it comes up with a problem.
At the very least, you might want to check dmesg and syslog.
Good luck,
Kel