/var/tmp is filling up... many files in /var/stm/logs/os

[Angie Meeks]

Our /var/tmp directory is filling up and most of the space is being consumed in the /var/stm/logs/os directory.

There are many files named logXXX.raw and they are of file type "awk program text"

Can these safely be purged?

Is there a manual or white paper that indicates that logs should be routinely purged on HP UX?

thanks
Angie

[Sridhar Bhaskarla]

Hi Angie,

You can remove all the files except *.cur and memlog files. It's a good idea to actually look at those files and see what is happening.

stm GUI (logtool) can provide you that information.

Look at the following document on information about these files.

http://docs.hp.com/hpux/onlinedocs/diag/logtool/log_data.htm#begin

-Sri

[Todd McDaniel_1]

My /var/tmp is linked to /tmp...

How is yours setup?

How is your data in /var/stm/logs/os/* affecting your /var/tmp?

Should be a different FS imho...

[Angie Meeks]

Sorry - I should have stated that my /var file system is filling up.


Thank you.
Angie

[Bharat Katkar]

Hi Angei,
Have a look at this thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=624564

Hope that helps.
Regards,

[MarkSyder]

Hi Angie.

In addition to the files already mentioned there are files in /var/adm that should be routinely cleared:

btmp, sulog, wtmp

syslog/syslog.log (check the file for errors or warnings first)

cron/OLDlog, cron/log

lp/log.

Do NOT delete any of these files - they are essential files, but you can clear them by:

> btmp

etc.

Mark Syder (like the drink but spelt different)

[Muthukumar_5]

Hai,

We have to rotate the log files using logrotate with cron tab.
It is good to check the file permission and it is contents.

raw files are real time files.
check this out. We have to be care to do the rotation. Use the time stamps of the file. If it too much behind now. It can be purged.

http://theresa.hostrealm.com/features.php?f=rawlog

Regards,
Muthukumar.

[Fabio Ettore]

Hi Angie,

as Bharat said check this thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=624564

I am going to give you the same answer that I already posted in that thread:

************************
This problem is a typical problem for /var.
Check the following:

1. cd /var/adm/syslog:
- you can move OLDsyslog.log to another filesystem;
- check mail.log, if you have old mail then you can trim this file:
# > mail.log

2. cd /var/adm/crash:
if there was a TOC then this directory is not empty and usually is enough large.
If you are not interested (date is very old) then you can delete all files under there.

3. cd /var/stm/logs/os:
here there are info for log of STM.
Keep logN.raw.cur and memlog and delete other files.

Just any thoughts...

Best regards,
Fabio