/var volume problem

[O'lnes]

I have two problems in my system:

1.the size of /var volume increase dramatically , but I can't find what file has increased the size , how to avoid it?
2.nothing write to the syslog, the size always is 0 , what is wrong in the file?

Thanks

[Patrick Wallek]

What is the exact file name? Make sure it is /var/adm/syslog/syslog.log Make sure there are no non-printable characters. Make sure permissions are correct. Make sure the syslog daemon is running. Make sure syslog.conf file is OK.

As fas as the /var increase, it could be due to print files, mail files, tmp files or other things are there temporarily and once printed or the mail is sent, they are going.

[MANOJ SRIVASTAVA]

Hi

YOu mena the size has decreased , /var is the home for lots of logs , all you can do it to do like this

cd /var
ls -l R | grep log and
check for which file is bulky

and trim it .
Check for /var/tmp as this doesnt get cleared when the system is booted


2. cd /var/syslog/syslog.log should ahve some entriers and also check for the soize of OLDsyslog.log
If the size of /var reduces then some logging gets stopped too ,

Manoj Srivastava

[Michael Tully]

Hi,

It is a little difficult to stop processes and files using /var as it can be a general dumping area. You can implement script(s) to look after the filesystem monitoring. Attached is a good example from Bill Hassell. To find the sub-directories that contain large amounts of space, run this command(s)

# cd /var
# du -sk * |more

You will most likely find that the problem lies within /var/tmp or if you have done patching recently in /var/adm/sw

Regards
Michael

[Patrick Chim · Accepted solution]

Hi,

For question 1, the above experts have given you the answer.
For question 2, I have seen it before. Maybe the syslogd daemon is hung up.

You can restart it then,
1. kill `cat /var/run/syslog.pid` and then type /sbin/init.d/syslogd start

OR

2. kill -HUP `cat /var/run/syslog.pid` to let it re-read it's configuration file

To ensure the syslogd is working, it can ftp to the machine with a valid user but wrong password then the syslog.log will show error.

Hope this help,

Regards,
Patrick

[KapilRaj]

/var/adm/utmp
/var/adm/wtmp
/var/adm/crash/core*
/var/spool/lp (do not remember the correct path)

hv a look at these files

kaps

[Dirk Wiedemann]

Hello,
you ask a lot of questions and receive a good deal of help, but you don't assign points to more than 100 responses.
Are the forums not helpful or jams your assign-button?
regards
Dirk

[Mark Fenton]

This happened recently here. The problem turned out to be that there was a "run away" print job that was filling /var. Normal methods of clearing the print spool weren't effective, I had to kill the individual's session.

(We've a fairly large database, but for most users, it's pretty difficult to come up with a query that would spit out more than a few hundred MB of print job -- this talented individual had managed to come up with a job over 8GB!)

good luck.

[Tony Flaherty]

hi,

You should be able to identify the big files by using find

cd /var

find . -size +10000000c -exec ls -l {} \;>/tmp/big_files

this will list all files greater than approx. 10Mb, change the value as required.

Tony