/var/dt/Xerrors file keeps growing and filling up /var

[Jerry Friend_1]

I have a J2240 workstation that has no monitor hooked up to it and I am using a laptop on the serial port as the console.

/var keeps filling up and it appears to be with errors being written to a file /var/dt/Xerrors

How can I disable the Xwindows service or prevent /var from filling up

[Rick Garland]

What kind of errors are being reported. Maybe should look at and fix.

In /usr/contrib/bin/X11/dr_dt run this file and see what it reports. Maybe a quick fix.

Are you running X windows on your laptop? If so you will need to have the process.

To stop the X windows do /sbin/init.d/dtlogin.rc.

[Jerry Friend_1]

We are not running Xwindows, the errors appear to be that no mouse is connected and that the service has died, repeating.

I just changed the /etc/rc.config.d/desktop file to read Desktop=0

and rebooted.

I want to disable the Xwindows server on the workstation we are just using it for a test environment and we don't run X

[Jerry Friend_1]

Forgive my ignorance... but /var is filling up and I am not sure why, I no longer think it is Xerrors

[Rick Garland]

In /etc/rc3.d is file called S990dtlogin.rc

Move this file to s990dtlogin.rc.bak and break the link.
X will not start on reboot.

To stop now, /sbin/init.d/dtlogin.rc stop

[Rick Garland]

Do this

# cd /var
# du . -ka | sort -nr | more

Will tell you what is the biggest offender in /var

[RAC_1]

What are the exact errors that you see??

Anil

[Jerry Friend_1]

sorry, please forgive my ignorance.

I stopped Xwindows server I think by running
/sbin/init.d/dtlogin.rc stop

and prior to that I rewrote the file /etc/desktop so that the variable

DESKTOP=CDE was changed to DESKTOP=0

that appearred to stop the console from trying to login to X and then I cleared the file /var/dt/Xerrors but, my /var filesystem is still full

This is a workstation that I have tried to setup as a test environment for my DBA to work in.

We are trying to clean it up and make it ready for her. Nobody here really knows much about Unix.

I was having problems with sendmail but I managed to stop that service as well. I am just trying to figure out what is filling up /var

I already trimmed the /var/tmp/wtmp file as well. Any other suggestions???

[Alessandro Pilati]

Jerry,
run these commands:

du -k /var|sort -n +0

it will order the files in your /var in incremental-spaceused-order.
See the files that are too big.

ls -ltr /var

it will give you the files in /var ordered by last access, so check the last of the list and it will probably be the guilty files.

Then post the result in the form so we can give you a better solution to stop the fulfilling of your directory.

Rgds,
Alex

[Jerry Friend_1]

Alex,

The output from du -k /var|sort -n +0 is too great for me to copy and paste it

can append | > /var/dump/tmp/sort_var.txt
and have it write to a file?

sorry I am more comfortable in windoze environment...

[Rick Garland]

Typically just need the first few lines.
These are the files that have been identified as the largest.

You mentioned trouble with sendmail earlier. How is the /var/spool/mqueue directory? Mail that cannot be sent out will spool in this directory.

Also look at /var/adm/syslog/mail.log.
The sendmail activity will be logged in this directory.

[Jerry Friend_1]

I ran this command:
esetest1# du -k /var|sort -n +0 |pg

and got this output:

0 /var/adm/acct
0 /var/adm/acct/fiscal
0 /var/adm/acct/nite
0 /var/adm/acct/sum
0 /var/adm/crash/crash.0
0 /var/adm/crash/crash.1
0 /var/adm/crash/crash.2
0 /var/adm/diag
0 /var/adm/eisa
0 /var/adm/streams
0 /var/adm/sw/queue/active
0 /var/adm/sw/queue/agent
0 /var/adm/sw/queue/complete
0 /var/adm/sw/queue/lckfiles
0 /var/adm/sw/queue/logfiles
0 /var/adm/sw/save/PHCO_16489
0 /var/adm/sw/save/PHCO_16489/NLS-AUX
0 /var/adm/sw/save/PHCO_16489/NLS-AUX/usr
0 /var/adm/sw/save/PHCO_16489/NLS-AUX/usr/lib
0 /var/adm/sw/save/PHCO_16489/NLS-AUX/usr/lib/nls
0 /var/adm/sw/save/PHCO_16489/NLS-AUX/usr/lib/nls/loc
0 /var/adm/sw/save/PHCO_16489/NLS-AUX/usr/lib/nls/loc/src
0 /var/adm/sw/save/PHCO_16490


Would the tail of the output be more important?

[Rick Garland]

Yes. Do the tail of the output.

The '-r' switch is the change from ascending /decending output

[Jerry Friend_1]

Maybe this will help

esetest1# bdf
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 143360 33398 103122 24% /
/dev/vg00/lvol1 83733 29223 46136 39% /stand
/dev/vg00/lvol8 663552 663221 331 100% /var
/dev/vgdb/prodb 12288000 3656 11900466 0% /var/progress/db
/dev/vgbi/probi 8192000 1244816 6512992 16% /var/progress/bi
/dev/vgai/proailog 8192000 6243094 1827106 77% /var/progress/ailog
/dev/vgai/proai 8192000 428444 7278341 6% /var/progress/ai
/dev/vgdb/dump 2048000 414464 1531947 21% /var/dump
/dev/vg00/lvol7 581632 463132 111156 81% /usr
/dev/vgapp/sps 1024000 1357 958735 0% /usr/sps
/dev/vgapp/dlc 1024000 414599 571419 42% /usr/local/progress
/dev/vg00/archive 819200 333642 455217 42% /usr/local/archive
/dev/vg00/lvol4 65536 2243 59402 4% /tmp
/dev/vgapp/trend 1228800 1435 1150662 0% /rd
/dev/vg00/lvol6 405504 147674 241943 38% /opt
/dev/vg00/lvol5 20480 1109 18168 6% /home




esetest1# pwd
/var
esetest1# ll
total 26
drwxr-xr-x 3 bin bin 96 May 22 2003 X11
drwxr-xr-x 11 adm adm 1024 Aug 5 10:29 adm
drwxr-xr-x 4 root sys 3072 Aug 5 10:25 dt
drwxr-xr-x 6 root root 1024 Aug 5 10:57 dump
drwxrwxrwt 2 bin bin 96 May 22 2003 home
drwxr-xr-x 2 root root 96 May 22 2003 lost+found
drwxrwxr-x 2 bin mail 96 Aug 5 08:41 mail
drwxrwxrwx 2 bin bin 96 May 22 2003 news
dr-xr-xr-x 11 bin bin 1024 May 22 2003 opt
drwxrwxrwx 2 bin bin 96 May 22 2003 preserve
drwxrwxrwx 7 root sys 1024 Aug 5 10:03 progress
drwxrwxrwx 2 bin bin 96 May 22 2003 rbootd
dr-xr-xr-x 2 bin bin 96 Aug 5 10:29 run
dr-xr-xr-x 10 bin bin 1024 Aug 5 10:30 sam
dr-xr-xr-x 13 bin bin 1024 May 22 2003 spool
drwxr-xr-x 4 root sys 96 May 22 2003 statmon
drwxrwxrwx 5 root other 96 May 22 2003 stm
drwxrwxrwx 3 bin bin 2048 Aug 5 11:06 tmp
drwxr-xr-x 2 root root 1024 Aug 5 10:29 tombstones
dr-xr-xr-x 6 bin bin 96 May 22 2003 uucp
drwxr-xr-x 3 root sys 1024 May 22 2003 yp

[Jerry Friend_1]

okay here is with r switch

esetest1# du -k /var|sort -rn +0 |pg
8653705 /var
7941898 /var/progress
6239986 /var/progress/ailog
1241708 /var/progress/bi
425336 /var/progress/ai
411818 /var/dump
261093 /var/adm
255489 /var/adm/sw
233880 /var/adm/sw/save
209500 /var/dump/patch
201260 /var/dump/dlc91b
66104 /var/dump/dlc91b/bin
27945 /var/dump/dlc91b/lib
23863 /var/spool
23785 /var/spool/mqueue
20575 /var/adm/sw/products
20341 /var/adm/sw/save/PHSS_22514
20213 /var/adm/sw/save/PHCO_23876
18972 /var/dump/dlc91b/tty
16924 /var/adm/sw/save/PHSS_23800
16519 /var/adm/sw/save/PHSS_22514/C-KRN/usr
16519 /var/adm/sw/save/PHSS_22514/C-KRN
15564 /var/adm/sw/save/PHSS_24627


Please note /var/dump and /var/progress are seperate filesystems and they are okay

[Rick Garland]

1st places I would look are;

/var/adm
the syslog.log and the mail.log files are here
could be other log files as well

/var/spool
the mail and lp spool files are here

/var/tmp
could be lots of temporary files here

What does the '# du /var -ka | sort -nr | more' say? What are the biggest files? This list will sort in ascending order so largest files will be on top of list

[Pete Randall]

You might want to run the cleanup command to commit superceded patches:

cleanup -c 1

Then run your du -sk command again.


Pete

[Jerry Friend_1]

Sendmail is disabled, there are mailer error messages in there

there are lots of files in /var/spool/mqueue
that is probably the problem

[Rick Garland]

The /var/dump directory looks big. What files are in there?

The /var/spool/mqueue looks big. Is mail being sent out of the system? Does the output from mailq command get smaller? It would appear that there a lots of mail files to be processes or mail files with big attachments waiting to be processed.

[Rick Garland]

With sendmail disabled, mail will still be processed and sent out from the system. With sendmail disabled, the system will not accept incoming mail messages.

Something could be generating mail to be sent out but the mail is not going out. Are the number of files in /var/spool/mqueue increasing?

[Jerry Friend_1]

/var/dump is a seperate filesystem it is okay

mail is the problem. I disabled sendmail, and there are lots of mail files that are clogging up /var/spool/mqueue

It looks like that is the likely culprit. I am sure it is because the sendmail server is not properly configured and EMS messages and such were builing up and then the undeliverable messages after 5 days compounded that problem

[Rick Garland]

Get the sendmail.cf file fixed so mail will be processed out of /var/spool/mqueue -or- start deleting mail messages from the /var/spool/mqueue directory. Keep checks with the mailq command. (Ex, /usr/bin/mailq | wc -l this will counts the number of lines. Do this command to see if the HPUX system is processing mail to be sent out.)

Remember, the sendmail daemon does not need to be running for the HPUX system to send mail out. This will in turn create these /var/spool/mqueue files.

If the HPUX system is unable to send mail out then the /var/spool/mqueue will increase with each new mail message to be sent out from the system.

The sendmail daemon needs to be running if you want the system to accept mail incoming.

[Jerry Friend_1]

I think I am just going to hire a consultant to come help us with the machine.

Sendmail is messed up, /var is still 90% full and I can't figure out where it is, I have tried what you all suggested, thanks for your help

[Bill Hassell]

It's very simple: the Progress database has filled up your /var directory. The sort -rn has put the largest directories at the top and it's my guess that /var/progress/ailog is a directory with some massive log files in it If Progress is not running, then zero the log files (don't remove them, just truncate them). To do this:

cd /var/progress/ailog
ll | sort -rnk5 | head

You'll see the largest file(s) sorted by size. For the biggest file(s), do this:

cat /dev/null > biglogfile.1
cat /dev/null > notsobiglog.2

and so on. I would also disable Progress from running if no one is using the database at this time.

The directory /var/dump looks suspicious too. That is not a standard HP-UX directory so someone has created it. Taking over someone else's machine is always difficult without some guidance from the previous owner. Windoze is the same way. A lot may be in a user's profile (My Documents) but a lot of important stuff may be in special C:\ directroies too.

[todd glassey]

use

/usr/dt/bin/dtconfig -d

to disable the CDE desktop login and use character mode.