/var with 97%

[augusto cossa]

Hi,

I'm facing some problems with /var directory. it's 97% and I have trimmed all log files under /var/adm/syslog directory but still 97%.

what have I to do to decrease it?

regards,
a cossa

[Patrick Wessel]

There is no general cookbook how to reduce the contens of /var
check if you have dumps under /var/adm/crash if they are old, get ride of them. if they are new, move them away and call your local responce center.
Any file called 'core' under /var? (find /var -name core)
Are there any huge log files from STM? (/var/stm/logs/os) if the are old, delete them but keep the one with the ending .cur
If they are all new, call your Hardware support

[Steven Sim Kok Leong]

Hi,

Some other filesystems you would like to check:
1) /var/mail
2) /var/spool/lp/request
3) /var/adm/cron/

Combine the "find" command with the -mtime command to check for latest added files or -size option for searching files in /var greater than a specific size. A cruder and less effective method would be to use ls -laRt to sort the files by most recently added first.

If possible, for dynamic directories residing in /var, split them away from /var as separate filesystems eg. /var/spool/lp/request.

Regards.

Steven Sim.

[Patrick Wessel]

Or you can sort all files in /var by size...

cd /var
du | sort -nr | more

and decide if you need the big ones...

[Andreas Voss]

Hi,

if you are running HP-UX 10.20 you can reduce
the patch database (superseded patches) by using the command:
cleanup
If you not have the command install patch
PHCO_12140

Regards

Andrew

[CHRIS_ANORUO]

You can trim to zero most of your log files using this command :
# /dev/null > /var/adm/wmtp.
Check your /var/preserve file to delete the EX*** files.

Regards

[Amir Fridman]

Hi !

You should try and modify the software product, and clear the old ones.
use the command :
swmodify -x patch_commit=true PH*.*

[Nikhil Chaudhari]

Hi

We have some log files in /var and we can trim it to 0 with the help of >

try to trim the log files

>/var/adm/wtmp
>/var/adm/syslog/syslog.log
>/var/adm/sulog
>/var/adm/btmp
>/var/tmp(delete complte dir)

also try to find out which files is taking max size anmd we can check it with.

du -sk /var |sort -n -r |more

with the above mentioned command you can fidn out who is occupying max.

also see if >/var/adm/crash

hope this will give you space upto 30 %

try this

thanks

regards

NIkhil

[frank beall_1]

move /var/adm/sw to a mount point.

mv sw sw1.

mkdir sw
lvcreate /var/adm/sw
then mv sw1 back to sw.

check /var/tmp for a large files

if you what to make /var bigger use ignite to redo the it.

[Eddie Warren]

It was a good suggestion to move /var/adm/sw to another mount point. Another option is if you have any disk space available. Check with "vgdisplay -v vg00", look at PE (physical extents)each PE is 4mb. If any space is available you could vgextend /var. to do this you would have to let the system reboot and bring it up in single user mode. Do a "mount -a", check what lvol is assigned to /var, unmount /var. vgextend /var's lvol,
extendfs completes it, then reboot.

[Fred Martin_1]

Have you checked /usr/tmp? In versions after 9.04, /usr/tmp is actually a link to /var/tmp.

Also user's mailboxes are now in /var/mail.

[Michael Marburger]

In my environment, I'm running PERF and am willing to delete the perf files if needed. The perf files are in /var/opt/perf/datafiles. I use this script to clean them up. It zaps history, but keeps me running at the present.

cd /var/opt/perf/datafiles
files=log*
for i in $files
do ls -la $i
done
if [ $n "$1" ]
then for i in $files
do echo "cleaning up " $i;
cat /dev/null > $i
ls -la $i
done
fi

[Emmanuel Eyer]

Well, you already have a lots of things to do ;-)

After checking log files, mailboxes and mailqueues (is your mail server dead?), printer queues (is a printer dead with a huge print job in the queue? I've seen once a 8 GIGABYTES job!), system core dumps...

The culprit could be just the patches! They are under /var/adm/sw, as other products, but here you'll get a patch subdirectory (or save in 11.x) that contains, for each installed patch, the old version of the files. If installed a couple of patch bundles, this could grow just huge. (check with du -sk /var/adm/sw/patch)

In version 10, use the cleanup command (no parameters) to remove all unnecessary files (those related to superseeded patches).

In version 11, you'll have to use the -x patch-commit=true option of swmodify (not completely sure - I donnot have 11 by hand).

Last hint: cleanup your SD-UX logs (/var/adm/sw/*.log) too...

Have fun! Emmanuel

[skarunanidhi]

Hi!
Many times, it is some huge log file which swallows the entire filesystem. Try this command to take a list of all files which are more than 1 mb in size and delete the unwanted files.

# find /var -size +1000000c -print -exec ls -al {} ;

Regards,
S.Karunanidhi

[Tom Danzig]

The biggest culprit in /var is usually /var/adm/sw/save. Anytime you add a patch, swinstall saves the old version of replaced files here. If you have no reason to believe you'll un-install as patch (if its like 1+ years old), you can safely delete that patches subdirectory here.

Such as (as root):

find /var/adm/sw/save -atime +365 -type d -exec /bin/rm -r {} ;