/var is full

[O'lnes]

the /var is full, but i find the shown size used is larger than actual size used ( du -sk), how to solve it?

Andy

[Michael Tully]

Hi,

You'll most likely find that the sizes don't add up because some files from these directories have increased in size but are still in memory. This can also be the case if you run the bdf command and the filesystem has been reduced in size but files have not been released. If you can track down the file(s) you can use fuser and/or lsof to fix your problem. The best place to start looking if you trying to reduce the filesystem from 100%
is /var/tmp, /var/adm/syslog /var/adm/sw, core files

Michael

[Bill Hassell]

To find the likely problem, use:

du -k /var | sort -rn > /tmp/du.var

Look at the /tmp/du.var for directories that are very large...there is likely something causing either large files of a massive number of small files. Likely candidates are /var/adm, /var/mail, var/tmp.

[O'lnes]

How to delete the file in memory?

Andy.

[Michael Tully]

You can't really delete a file in memory. It has to actually be released to do this properly. You can delete the file that is in use, but the space is not recovered. You would need to terminate these processes.
Use Bill's suggestion to look for files that can be trimmed.

[O'lnes]

Hi Bill,

I use the method to find the file in /var , but still can't find the large file.

Andy.

[O'lnes]

I recall that the system generated a 800M size file in /var , then i hv move the file to other directory, but the used size is still 100%, it seems not yet remove from memory.

Andy.

[Michael Tully]

If you've moved a file that is still resident
in memory, the file location will have moved,
but the space will not be recovered. Suggest
you use the 'lsof' utility to find which
process has ownership of that file. Once the
process has been terminated, the space will
be recovered.

[Kenny Chau]

Hi Andy,

As I remember, you can use ipcs to show which files are hold in the shared memory and you can use ipcrm to remove it.

Please man ipcs and ipcrm for more information.

Hope this helps.
Kenny.

[O'lnes]

my system do not have lsof , where can i get it?

Andy.

[Michael Tully]

Hi,

You can get an already compile version here, as well as the man page. You install it using the 'swinstall' tool.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.61/

[Darrell Allen]

Hi Andy,

If bdf /var and du -sk /var report a significant difference in the size of /var, then it sounds like the file you moved was still opened by a process when you moved it. To all new processes (including du) the file is in the new location. The process that had the file open still thinks it is where it was originally. The space the file originally used remains allocated by the OS until the process closes that file. That's why bdf will report more space used than du does.

This happens often when someone deletes or moves a log file such as /var/adm/syslog/syslog.log.

Darrell

[Tim D Fulford]

above all correct...

try
/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

& see if /var is still full.

Tim

[U.SivaKumar_2]

Hi,
Also
#/sbin/init.d/sendmail stop
#/sbin/init.d/sendmail start
For finding the process using /var
#fuser -u /var
27849o(root) 27862o(root) 27872o(root)
where the numbers above are PIDs of processes
running on /var. To find out the process,
#ps -ef | grep 27849
#ps -ef | grep 27862
#ps -ef | grep 27872
Try to kill the process , after this verification only.
A reboot will be of much help.

regards,
U.SivaKumar

[O'lnes]

hi all,

i tried the following , but still not work

sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

#/sbin/init.d/sendmail stop
#/sbin/init.d/sendmail start

#fuser -u /var
/var:


Andy.

[Bill Hassell]

It's almost impossible to run in multi-user mode and be able to un-mount /var so about the only choice you have is a reboot. AS I mentioned, there may be *NO* big files, just thousands of small temp files. That's why you look at the contents of the largest directories to see what's there.

Now if teh biggest directories look normal, and there is a big difference between du, ll and bdf, the reason is that a large file (or files) has been deleted but it is still open. The space cannot be recovered until the program(s) release the open file.