VAR partition 100% full, what can I do so make some space?

[Victor_138]

Result of bdf

Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 147456 23378 116386 17% /
/dev/vg00/lvol1 83733 31469 43890 42% /stand
/dev/vg00/lvol9 1536000 1536000 0 100% /var
/dev/vg00/lvol8 659456 408248 235527 63% /usr
/dev/vg02/lvol4 8192000 4254045 3692009 54% /u08
/dev/vg02/lvol3 9216000 6425344 2616309 71% /u07
/dev/vg01/lvol4 7168000 4099421 2876799 59% /u06
/dev/vg01/lvol3 2048000 357290 1585045 18% /u05
/dev/vg02/lvol2 2048000 83537 1841689 4% /u04
/dev/vg02/lvol1 2048000 187017 1744677 10% /u03
/dev/vg01/lvol2 3072000 33123 2848952 1% /u02
/dev/vg01/lvol1 3072000 636569 2283270 22% /u01
/dev/vg00/lvol7 65536 1541 60046 3% /tmp
/dev/vg00/lvol6 618496 162932 427129 28% /opt
/dev/vg00/lvol5 24576 1110 22007 5% /home

What can I do to make some room quickly in order to avoid a crash?

[Victor_138]

I'm also trying to run SAM and it's taking for ever.

During the process the following message appers

+---------------------------------------------------------------------------+ |
|| ^ |
|| |
vxfs: mesg 001: vx_nospace - /dev/vg00/lvol9 file system full (1 block extent) |
vxfs: mesg 001: vx_nospace - /dev/vg00/lvol9 file system full (1 block extent) |
|| |

[Pete Randall]

SAM probably write to /var - it probably won't come up until you clear some space. Start with /var/tmp - most anything in there can be removed. Then run the cleanup command to commit superceded pathches - "cleanup -c 2". The check /var/adm/crash and clean out any old crash dumps. After you free some space and SAM comes up, go into SAM > Routine Tasks > Trim Log Files and trim the log files down to size.


Pete

[Morcos]

start by checking and cleaning /var/adm/crash , and by trimming /var/adm/wtmp.

Ziad

[Victor_138]

Thanks, forgot 1 very important piece of info. I'm running 10.20.

[Bharat Katkar]

In addition to this, use "find" to check if any large sized file are present in /var. Identify the files which are not required and delete them. Some user might have written or copied huge file to /var.

/var is basically used for maintaining various log so trimming of log files can also releive from this congestion.


Regards,

[Juan M Leon]

I will check the log files under /var
also make sure there is not process running and holding inodes on /var/tmp.
run the following
fuser /var/*/*

[CAS_2]

(1) Check below the directory /var/adm/crash

(2) Check how much space is used by /var/tmp:
du -skx /var/tmp

(3) Check how much space is used by other directories below /var:

cd /var
du -skx * # this command may last long.


P.D: Anyway, I think that 1.5 GB size for /var is not enough.

[Marvin Strong]

Well 1.5GB var is kinda small IMO.

If you have space on your root drive. I would clear up some logs, and extend the /var filesystem, of course to do that requires you to be using vxfs filesystems and have OnlineJFS.

baring that.

figure out where the largest files are and deal with them.
du -sk /var/* | sort -n

Most common files. /var/adm/wtmp might be quite large.

/var/adm/sa directory if you are running sar.

[Sandman!]

Run du command on /var FS in order to determine which files are filling it up.

# du -kx /var | sort -nr | more

Also make sure that there is no discrepancy between bdf and du on the amount of space used in /var. If there is then check for deleted files that might be held open by running processes with lsof:

# lsof +aL1 /var

If the above command produces output then recycle the apps/procs that are using /var.

lsof is available here:
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.76/

With OnlineJFS you can try extending /var without unmounting it if storage is available.

cheers!

[DCE]

If you have yet cleaned up your patch installs (and 10.20 has a lot) you can free up a lot of space with the cleanup command. Unfortunately the syntax ahas changed from 10.20 to 11 and I do not remember the difference. A man on cleanup should give it to you.

Dave

[Victor Fridyev]

Hi,

Run du -ks /var/* | sort -nr and
bdf /var

If you see a big difference between total disp space, you have a deleted opened file[s] in the file system. In this case you may use lsof in order to find the process, which locks the space.
If the difference is small, look at the directories in the top of
du -ks /var/* | sort -nr
output. One of the possible candidates is /var/adm/wtmp or /var/adm/crash. Also running of cleanup is an excellent idea.

HTH

[VIKAS AGRAWAL]

Hi,

Var dirctory is used mostly for log files only. u can trim the following files ,

# use it like this

# > /var/adm/utmp
# > /var/adm/wtmp

/var/adm/utmp , wtmp . do not remove any files apart from crash dumps , crash can be found at /var/adm/crash.

U can trim the mails also. Goto /var/mail there u will find lot of files wtih user names just trim them also .

then check preserve & spool directory & trim the log files . this will atleast some space to breath


dont forgot to assigne points

[Ranjith_5]

Hi,

try the following script for finding the large files and you can delete them if not required.


#Syam
#TCSL
#26/01/2005
#
#
rm -f find.out

echo
echo "Enter directory to search"
read DIRNAME

if [ ! -d $DIRNAME ]
then
echo "Error: directory $DIRNAME does not exist"
exit 1
fi

echo
echo "How large a file do you want to look for ? (in Kbytes)"
read SIZE

echo
echo "How many days since the file was created ?"
read DAYS

echo
echo "Searching..."

find $DIRNAME -type f -size +$SIZE -mtime -$DAYS -exec ls -ls {} \; | sort -n -r | tee find.out

echo
echo "Done"
echo
echo "Note: output in find.out"
echo



Regards,
Syam

[Tim D Fulford]

cd /var
du -sk * | sort -n

go through this list and work out what is necessary. Unfortunately this is a common problem and is very much dependant upon how well you know how the useres use the system.... typical areas to look in are

/var/tmp/ ... this should be full of tempory rubbish!

/var/adm/syslogs/ ... should be the last place to purge info from, but very often is the first and easiest... syslog.log, OLDsyslog.log mail.log

Regards

Tim

[James R. Ferguson]

Hi Victor:

As noted, running:

# du -xk /var | sort -rn

...will return the largest directories and files within /var sorted in descending size order.

Whatever you do, do _NOT_ remove files in the '/var/adm/sw' directories. These are your database of Installed Products (IPD) used by the SD (Software Distributer) tools -- 'swinstall', 'swlist', etc.

Instead, to reclaim space in this directory, use the 'cleanup' command:

# cleanup

Since you indicated that you are running 10.20, there are are very limited options that you can supply to the command. Running it without any will prompt you to trim log files (yes, do that), and will preserve enought patch information to be able to back out any current patch one level.

Other directories that may contain large or numerous candidates for removal or trimming are: 'var/tmp', 'var/mail', '/var/adm/crash',and '/var/adm/lp'. They are good places to look for thing to remove.

As noted, certainly look at the size of '/var/adm/wtmp' and /var/adm/btmp' if present. You can trim these to zero by redirecting '/dev/null' to them.

Regards!

...JRF...

[Stephen Keane]

Do you have a directory /var/adm/preserve ? If so anything large in it?

[Victor_138]

Thanks everyone for the very helpful info.

Was able to solve the issue for the time being.

Victor