/var file system 98%

[M.sureshkumar]

Hi All,

one of my unix server,/var file system is 98% usage.How to find out the largest file in /var.

In "/var/stm/logs/sys", the file "diaglogd_activity_lg" is taking 200MB size out of 100MB(Total /var size).

What is the purpose for "diaglogd_activity_lg".
Is it possible to truncate this file?

Please guide me how to proceed further?

Regards,
Sureshkumar.

[RAC_1]

du -kx /var | sort -n --> Will give largest dirs sorted in ascending order.
Once largest dirs are known, run following du command on them to know largets files/dirs under them.

du -kx /var/dir1/* | sort -nk1

[Devender Khatana]

Hi,

This is a STM log file and is updated everytime when STM is run. The timestamp shall show you the time when last your server was rebooted or stm was run. DO not remove it completely copy it to some free file system first and then redirect it with null by

#>/var/stm/logs/sys/dialogd_activity_log

If this do not free space you should restart the diagnostic by

#/sbin/init.d/diagnostics stop

#/sbin/init.d/diagnostics start

HTH,
Devender

[Geoff Wild]

Other way to free up space - cleanup patches:

cleanup -c 1

You could aslo increase the size of /var - if you have room in the volume group.

lvextend -L /dev/vg00/lvolXX

fsadm -b M /var

Example - increase var to 2 GB:

# bdf /var
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol10 1048576 356284 651529 35% /var

lvextend -L 2048 /dev/vg00/lvol10
fsadm -b 2048M /var


Rgds...Geoff

[Sanjay_6]

Hi suresh,

You can delete this log "dialogd_activity_log" file without any problem using the rm command. When STM sees the file is missing, it will recreate it.

Hope this helps.

regds

[Steven E. Protter]

Shalom,

Sam has a nice interface for cleaning up log files under routine tasks. Its usually good for some disk space.

Your /var filesystem should be big enough so that 200 MB of stm files should not clog it up.

I'd look elsewhere for space, but you may delete that file. At least the 200 MB will keep your system from halting.

SEP

[Raj D.]

Hi Sureshkumar ,

You can delete the file or nullify it.


#/sbin/init.d/diagnostics stop

# >/var/stm/logs/sys/dialogd_activity_log

#/sbin/init.d/diagnostics start


Cheers,
Raj.

[Bill Hassell]

/var (and /tmp and sometimes /home) will always need constant monitoring. But do not look for large files! Look for large directories first. The du | sort commands above will summarize the largest directories. /var is may need to be 500megs to 5000megs in size--it all depends on what you are doing and the temp storage requirements. A lot of active printers may consume several hundred megs at times, email could also consume dozens of megs and /var/adm will always grow as most of the system logs are located in this directory.

Once you find the large directories, use the command:

ll | sort -rnk5 | head -15

to see the big filers in the current directory. It is not a good idea to blindly delete log files. Instead, determine what the log contains, check for important information and then reduce the logfile either with vi or by copying /dev/null on top of the file. Doing this will keep the original permission and owneership.

[rariasn]

Hi sureshkumar,

/ocupacion.sh /var > /tmp/var.txt

[Sreejith K]

Hi suresh

You can remove core files from /var/opt/dce/dced , u can trim root and other mails copy it to some other location.(/var/mail)if u don't have any required information in that.In /var/adm u can trim wtmp,wtmpx, btmp,btmpx etc .

Regards

Sreejith K

[Muthukumar_5]

You can take steps as,

1) Removing superseded patches as,

cleanup -c 1

2) Removing old logs which will have the name of OLD*.

find /var -name "OLD*" -exec rm -f {} \;

3) You can trim log files also as,

>

diaglogd_activity_lg is used to capture diagnostic messages. Stop daemon and remove the file and start it again.

Find largest files in /var/ as,

# find /var -type f -exec ls -l {} \; | awk '{ print $5,$9 }' | sort -rnk1 | more

--
Muthu

[Adisuria Wangsadinata_1]

Hi Sureshkumar,

For STM log files, just follow the steps below :

1. Stop STM using either:

# /sbin/init.d/diagnostic stop

or:

# xstm
File --> Administration --> STM Shutdown

2. Move or remove any files under the /var/stm/logs directory
structure using the rm(1) command that are oversized/full and are taking up
excessive room. Some files to look at are
/var/stm/logs/sys/activity_log,
/var/stm/data/diaglogd_hold_list,
and /var/stm/logs/sys/diaglogd_activity_log.

3. Restart STM using either:

/sbin/init.d/diagnostic start

or:

# xstm
File --> Administration --> STM Startup

New log files will be created automatically.

Check the url below (docID : KBRC00013492) about 'Removing STM Log Files' :

http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000079988548

And this url (docID : 1200411519) about 'HP-UX SYS ADM: how long should files in /var/stm/logs/os be kept?' :

http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000080065666

You can also trimdown the other system log files on /var file system by using SAM :

SAM > Routine Tasks > System Log Files > select the log files that you want to trim > Actions > Trim > either 'Trim to Zero' OR 'To the Recommended Size'

Hope this information can help you.

Cheers,
AW