/var maintenence

[Andrew Beal]

Hi,

Our /var filesystem is 95% full, and I dont have any space left to increase it :(

I was looking through it for files over 1MB and saw alot of files from Perf View, cstm, ignite, OV, and something in /var/adm/sw? (I am guessing software distributor).

I have also cleaned out the /var/tmp dir, but that did not clean up much space...

So I was wondering if you could compress or delete any of these files from the above applications, and if so, what type of files, and how long their life span should be?

Thanks in advance,

Andrew

[Michael Tully]

You could start with some of the SD logs, swagent, swinstall etc and trim these down. You could also clean up old software using the cleanup command. 'cleanup -c 1' will get rid of all patches but the last patch bundle. ALso have a look at /var/adm/btmp and /var/adm/wtmp. Be aware that trimming these files, reduces the amount of old login/unsuccessful login information.

Do you have any files in /var/adm/crash that are old?
You could remove most the old files in /var/tombstones

[Con O'Kelly · Accepted solution]

Hi Andrew

There's alot of potential files that can be cleaned up.

1) cleanup -c 2 will committ patches superseeded twice. Use -p to preview.
(attached script will show space reclaimed by committing patches.)

2)The files in /var/opt/perf are part of measureware. The log files in the /var/opt/perf/datafiles directory. shouldn't be removed but you can set limits on their size in the /var/opt/perf/parm file.

3) Other potential files to look at
/var/mail/
/var/adm/sa (if it exists)

4) A # du -skx /var/* | sort -rn | head -20.
will show your biggest directories etc.

Cheers
Con

[Andrew Beal]

Thanks for your response,

I deleted the old tombstones, and there was only 1 REALLY small file in /var/adm/crash.

When you say "Trim" the logs, what do you mean by that exactly? Can I delete them?
Will that break the applications?

Or just vi the logs, and remove really OLD information??

thanks again,

Andrew

[Rajeev Shukla]

Hi,

trim means either make the files 0 size by doing > say to syslog you want to do then do
#>/var/adm/syslog/syslog

Also this can be done by SAM-->routine task-->System Log files and select the file you want to trim an din actions menu you can trim.

Also celanup -c 1 will give you a lot of space.

Cheers
Rajeev

[Con O'Kelly]

Really depends on the size of the log file. If they're only a few MB's, you're probably not going to get much space back. If they're really big then:
# cp
# gzip logfile.old (& possibly move to bkup directory on another FS)
# cat /dev/null > logfile.
(cp & gzip not strictly necessary but good idea to have a backup)

What's the size of your /var??
You probably need to identify the largest directories/files.
Can also use:
# du -kx /var | sort -rn | head -20.

Cheers
Con

[Michael Tully]

'SAM' has a good log trimming routine. Trimming means removing the bulk of the detail and leaves behind a smaller file, which remains in memory if there is a process associated with it. Do not just remove files. Some which are still memory will not actually be reduced if you "just" remove it.

sam --> Routine Tasks --> System log files.
Select the files and away you go. /var/adm/lp logs are another good one. As mentioned before, be careful how much you trim from /var/adm/btmp and /var/adm/wtmp

[Sanjiv Sharma_1]

Hi Andrew,

Here is a previous on the similar problem:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x2e095fe8b250d71190080090279cd0f9,00.html

hth.

[Bill Hassell]

The easiest way is to use SAM to trim the logfiles. Most logfiles like syslog and mail.log are plain ASCII so you can use tools like head and tail to trim these files. But /var/adm/wtmp and /var/adm/btmp are binary and require special handling. If you use SAM, it will do the right thing for you.

Now this can get to be tedious for a lot of servers so you'll want to script the trimming steps and run them through cron.

Use the du suggestion to locate big directories first, then look inside the biggest directories to see if there are any large files. NOTE: The /var/adm/sw directory has critical information about patches and installed software. The cleanup command will handle these files properly. Don't remove any files from /var/adm/sw/save or you may mever be able to patch your system again.