/var getting full

[machaya chivaviro_2]

I need to free space on this file system. What files should I take off.
drwxr-xr-x 12 adm adm 1024 Oct 6 19:07 adm
drwxr-xr-x 4 root sys 1024 Apr 14 19:20 dt
-rw------- 1 root sys 376 Jul 9 2004 history
drwxrwxrwt 2 bin bin 96 May 8 2003 home
drwxr-xr-x 2 root root 96 Sep 23 1999 lost+found
drwxrwxr-x 2 bin mail 9216 Oct 6 20:30 mail
drwxrwxrwx 2 bin bin 96 Sep 23 1999 news
dr-xr-xr-x 15 bin bin 1024 May 8 2003 opt
drwxrwxrwx 2 bin bin 7168 Oct 6 19:07 preserve
drwxrwxrwx 2 bin bin 8192 Jun 1 15:42 rbootd
drwxrwxrwx 3 root sys 96 Sep 19 2002 requests
dr-xr-xr-x 2 bin bin 1024 Oct 6 19:07 run
dr-xr-xr-x 12 bin bin 2048 Oct 6 19:10 sam
dr-xr-xr-x 15 bin bin 1024 Sep 19 17:51 spool
drwxr-xr-x 6 root sys 96 Aug 6 2000 statmon
drwxr-xr-x 5 root other 96 May 8 2003 stm
drwxrwxrwx 21 bin bin 13312 Oct 6 20:30 tmp
drwxr-xr-x 2 root root 2048 Oct 6 19:07 tombstones
dr-xr-xr-x 6 bin bin 96 Sep 28 1999 uucp

[Patrick Wallek]

Well, this listing really doesn't tell us much.

Things to check in /var:

size of /var/adm/syslog/syslog.log?
size of /var/adm/syslog/mail.log?
Any crashdumps in /var/adm/crash?
Any large files in /var/tmp?
Can you committ superceded patches? (man cleanup for more info.)

Try this to get a listing of the largest dirs in /var:

# cd /var
du -ks * | sort -n

[Pete Randall]

The only place you can safely delete from is /var/tmp. Others require careful consideration. Use SAM > Routine Tasks to trim logs. Run the cleanup command to commit superceded patches (man cleanup for details). And what is in /var/home?


Pete

[Rick Garland]

Start by looking to see what is the biggest offender

cd /var
du . -ka | sort -nr | more

This will provide a list of files from biggest in size to smallest.

Look at the /var/adm/syslog directory. Big syslog.log and/or mail.log? (Do not remove these files. Copy them elsewhere and the 'cat /dev/null > syslog.log')

Can you do the 'cleanup' command on committed patches?

Do you have crash dump files residing on the /var partition? If so you might want to remove these.

/var/tmp could be a possible candidate for file truncating/removal.

Is the mail running on this system? What is output of 'mailq' command? If lots you may want to look at /var/mail.

Don't forget some of these directories could be separate filesystems. What is the bdf output?

What you have listed above are mostly directories. Need to look into these directories and see what is present.

[Rick Garland]

Sorry, command should be 'du . -ks | sort -nr | more'

I have 'du -ka ...'

[Devender Khatana]

Hi,

Rather than directories see the contents which are occupying more space within these directories. You can not remove any f these directories.

This can be done by

#pwd
/var
#du |sort -rnk 1 |head -20

HTH

[Tom Danzig]

Typically on most systems, committing patches usually will free up the most disk space. USe:

cleanup -c 1

[DCE]

/var, by the nature of the files written to it will continously grow unless you monitor it and periodically perform file maintenance. All of your log files go there and most do not have an upper limit i.e. syslog, mail.log wtmp, etc. You cannot simply delete/recreate these files since the system does have them open. you need to do a command such cat /dev/null > /var/adm/syslog to zero out the file (after backing it up)

The software/OS patches are stored there as well. As others has recommended, cleanup -c 1 will remove old superceded patches from the directory. Do not remove them manually s that will cause problems with future patch installs.

/var/tmp is just that a temporary storage area - it should be cleaned up periodically.

Finally /var/spool has the potential for using a lot space - unsent mail messages and prints are queued up there.

[Raj D.]

Hi Machaya,

1.You can try checking the biggest files on /var first :

# cd /var
# ls -lR | sort +4 -5nr | more

2. Also check the usual files that grows :

/var/adm/syslog/mail.log
/var/adm/syslog/OLDsyslog.log
/var/adm/wtmp

You can nullyfy the mail.log and wtmp

#cat /dev/null > mail.log
or
# >mail.log


Cheers,
Raj.

[Vincente Fernandes]

/var/adm/sw is another place to check for space. Do a cleanup -p to preview how much space is used by old patches. Then do a cleanup -c 1 to committ old patches which are already superseeded by atleast 1 new patch. This way /var filesystem will be reduced.

[Stephen Keane]

Also look at /var/adm/crash and make sure you don't have lots of directories such as crash.1 crash.2 etc in there.

[Marvin Strong]

A bit off topic but you should set /var/preserve to 1777 for security reasons.

If you're running sar, /var/adm/sa can certainly take up alot of space.

If large print jobs go through the host.
you might want to check /var/spool

du -sk * | sort

will give you a good idea where to look.

[Marvin Strong]

/var/tmp should be 1777 also for security reasons.

[machaya chivaviro_2]

du . -ks | sort -nr | more
gave me the following result
881282 .
464860 ./preserve
172382 ./adm
120878 ./stm
99994 ./stm/logs
98498 ./stm/logs/os
57364 ./opt
45942 ./opt/ignite
36210 ./opt/ignite/recovery
34050 ./sam
33672 ./sam/log
19794 ./spool
17678 ./opt/ignite/recovery/2003-05-10,05:59
15606 ./opt/ignite/recovery/2003-05-08,19:15
13860 ./stm/data
13078 ./stm/data/tools
13062 ./stm/data/tools/verify
13060 ./spool/lp
12278 ./spool/lp/request
9156 ./opt/ignite/logs
8028 ./mail
7024 ./stm/config
6998 ./stm/config/tools

[Adisuria Wangsadinata_1]

Hi,

You can trim down the system log files at /var file system with SAM :

SAM > routine tasks > system log files

From your info, these file can remove also (since from year 2003, it's Ignite/UX backup archive) :

17678 ./opt/ignite/recovery/2003-05-10,05:59
15606 ./opt/ignite/recovery/2003-05-08,19:15

For safety reason, please do backup before you remove any file from your system.

Hope this information can help you.

Cheers,
AW

[Devender Khatana]

Hi,

Are there plenty of superceding patches. These can be removed from /var directory using

#cleanup -c 2

Man cleanup for details.

HTH,
Devender

[Stephen Keane]

What do you have in /var/preserve ? Have you edited a very large file recently and crashed the editor? /var/preserve should mostly be empty.

[radi_1]

check the size of /var/adm/wtmp file,if its big,then tail it to a new file,
#cd /var/adm
#tail wtmp >wtmp.new
#cp wtmp.new wtmp
Otherwise search for other big files:
#find /var -xdev -size +10000 -exec ll {} \;

[machaya chivaviro_2]

/var/preserve has more files. like
Exaao00482. Can I delete these what are they for.

[Devender Khatana]

Hi,

Yes these files can be deleted.These are files saved by vi editor perhaps when it crashes or the session having opened that vi session exists abnormally.

The files with old timestamps can be removed easily and the files with recent ones can be moved to some other locations.

HTH,
Devender