/var directory still full even after I removed some data

[Joshua Goi]

Hi!

My /var directory is still at 100% even after I removed some directories under it. Is it possible there are some log or dump files in there that kept growing? Thanks and appreciate any advise!

[Rodney Hills]

You could have a run away process taking all the space as you free it up.

The file wouldn't show up in the directory until the process closed.

Use "lsof" to try to find the culprit.

HTH

-- Rod Hills

[A. Clay Stephenson]

Your problem is that rm does an unlink and if the link count is now 0 the directory entry is removed BUT the space is only returned to the filesystem when all porcesses which had the file open either terminate or close the file. You need to user lsof or fuser to see what processes still have the file open and kill them.

Man 2 unlink for a better understanding of your problem.

[Joshua Goi]

A runaway process? Exactly how can I find out if it's that's the case?

"lsof" doesn't seem to be a valid command when I typed it.

[Joshua Goi]

I did a reboot after I have removed those directories so that should have killed those processes or any users. But the space is still showing 100%. Weird.

[Fred Ruffet]

All info may be in this thread :
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=757621

Regards,

Fred

[Fred Ruffet]

If you issue a reboot and still have space used, then you didn't remove the good files :)

To see a good report of space, use this :
du -ksx /var/*

This will give you size report for any element under /var. Change /var to anything to find more space-using element.

Regards,

Fred

[Mark Greene_1]

There are some more obvious places to look.
Do an ls -l on the following:

/var/adm/lp/log <--lp log file
/var/adm/syslog/* <-- syslogd log files
/var/tmp/ <-- system work space
/var/adm/sw <-- lots of log files here
/var/adm/sw/products <-- patch files
/var/lost+found <-- misfiled files
/var/opt/ignite/logs <-- logs from bootable backup

mark

[Gordon Morrison]

You could also try this:

cd /var
touch junk
(delete a file under /var)
find . -newer junk

That should show up the file(s) being written to. Then do either:

> file
(only if the contents are not needed)

or...

fuser

and if it's appropriate, kill the process writing to the file

[Nguyen Anh Tien]

/var contains many kind of log file. each is put in private subdirectory.
You can find bigest directory by using this command
#du -sk /var/* |sort -nr
1144688 /var/adm
207736 /var/opt
13224 /var/stm
4752 /var/dmi
616 /var/sam
528 /var/tmp
408 /var/asx
240 /var/tombstones
144 /var/vx
112 /var/spool
96 /var/yp

and then you track large file in each subdirectory again.
Or you also find big file by using find command.
[trn0:/] find /var -size +10240000c
This command finds all file sized over 10240000byte.
tienna