/var is full

[sapi]

all,

I have server that sometime /var is full (100%) in bdf command.

# du -sk /var
526264 /var
# bdf /var
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol7 2097152 2097152 0 100% /var

why ??

[Steven E. Protter]

Shalom sapi,

Most likely there is a file deleted but a process still has the filehandle open. Therefore the space is not available.

Id the processes on /var

fuser -cu /var

Kill the procs on /var

# NOTE: This may kill your entire system.
fuser -cuk /var

Identify actual files

cd /var
du -k | sort -rn | more

SEP

[Arunvijai_4]

Hi Sapi,

Find out what occupies more on /var by the following command.

# du -skx /usr/* | sort -nr | head -25

-Arun

[sysadm_1]

Hi Sapi,

Check which folder/file is taking more space in /var using command,
du -skx /var/* |sort -nr | head -25

it will list the folders with size in kb.

delete the unwanted files from these.Check also
/var/adm/crash folder and clear if there is crash dumb created.

Cheers!!
sysadm

[Hemmetter]

Hi sapi,

since your du shows about 500 Mb used while bdf says /var is 2Gb check for deleted but still allocated files:

# lsof +L1 /var | grep VREG | grep -v mem | sort -k7n

You my need to restart the process holding the biggest ones.

rgds
HGH

[sapi]

hmmm...

/var is full at 12:00 AM and at 03:00 PM, /var is back to normal (27%). I don't do anything.
hoe to check that there are some applications that used /var for instant time?you know that, with du -sk and bdf command have different yield.

[JASH_2]

Sapi,

/var/tmp is used to vi files. If someone was vi-ing a large file it could have temporarily filled up var.

Regards,

JASH

[Ronaldinho]

Hi Sapi,
do you have scheduled jobs at those times? what is in your crontab?
crontab -l

regards,
John

[Muthukumar_5]

check with fuser as,

# fuser -u /var

will give that /var/ directory usage.

Another reason may be transferring files to that directory or log file(s) are getting filled.

--
Muthu

[Roland Piette]

Hi,

Because installation of patches, I suggest also to use the cleanup command. See man page for more details.

Roland

[sapi]

all,

there is normal condition in /var:
$ sudo du -sk *
16 X11
11176 ace
127368 adm
408 asx
3408 dmi
304 dt
0 empty
0 home
104 hponly
0 ifor
0 lost+found
14608 mail
0 news
0 obam
162384 opt
0 parmgr
6952 preserve
712 rbootd
24 run
656 sam
8 sdconf.rec
472 spool
16 statmon
50240 stm
149824 tmp
2176 tombstones
0 uucp
400 vx
96 yp
$ bdf /var
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol7 2097152 545816 1548456 26% /var

there are applications that used /var/tmp but in cronjob, there is a job that deleted file under directory /var/tmp every 5 minutes.