/var full

[Bedare Nikhil]

One of my friend told me the problem he was facing.
/var of an server was full, so he was not able to telnet to that server but when he tried to do an ssh,he was able to login successfully.How is this possible ??

[Peter Godron]

Hi,
and welcome to the forums !
When you install ssh in the makefile a number of directory directives can be set.
I assume these did not point to /var.

Most people have monitoring script to warn of system partitions going full.
Like :
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=847833

Please also read:
http://forums1.itrc.hp.com/service/forums/helptips.do?#33 on how to reward any useful answers given to your questions.

[George Liu_4]

Also could at some time /var be not 100% full. It is a dynamic partition.

[Bill Hassell]

/var is the MOST critical directory in the system and it also changes size very fast. As you have seen, when /var is full, a *LOT* of things failed, not just telnet. logfiles stopped (and their daemons may terminate or crash), printing stops, email stops, and on and on. There are so many processes that depend on /var, it can never be allowed to fill up. Managing /var requires a disk space monitoring script with notifications sent to sysadmins to fix the problems. Neither telnet not ssh use /var...the problem occurred during login, probably due to syslogd and the security programs adding the user login to the logfiles and running profiles.

[Michael Steele_2]

Dear Bedare:

Regarding "...but when he tried to do an ssh he was able to login successfully. How is this possible?..."

This would be possible if sshd was filtered out of /var/adm/syslog/syslog.log or redirected into another file. So check the sshd configuration files. You can refer to this doc for guidance.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=267234&admit=-682735245+1166141269619+28353475