VM

[Jennifer Money]

I received a message in my syslog that one of my FS was full yesterday a.m. I look at the FS today and there is plenty of space. I am originally a SUN child and am new to HP-UX, so I am still learning HP-UX little quirks. Any ideas on why a FS is full for two days and then isn't on the 3rd? Should I just go ahead and grow everything starting with the volume group, just to be safe?

[Andreas Voss]

Hi,

one reason could be that a user has done a core dump by crashing his application.
Possibly there is a cron job on your machine that looks for core files frequently and removes them.

Greetings

Andrew

[Rick Garland]

Many processes may use FS space for temp use.
After the process is complete, the FS space is reclaimed.

[Brian M. Fisher]

A common occurence I have seen is a user copies or uncompresses data, gets a File System full message then deletes what they were doing. For the time being I would keep an eye on the disk capacity via a script that runs every 10 minutes or so and E-mail or pages you if a file system is over 90% capacity.

Brian
<*(((>< er

[Antoanetta Naghiu]

In addition to those, clean up of logs of different application (I had once application that purge periodically logs) or archive and move those....
Just keep an eye on syslog which FS was, run du time to time to cach what happened. At this point I would not go to increase vg and lvs.

[Dave Wherry]

Two other scenarios I have seen that can cause this.
I've seen fbackup flake out and not write to the tape drive, but, write to a file on the disk. When the job aborts or is killed that file can just disappear or may need to be removed.
Secondly, if a process is writing to a file, has it open, and that file is removed the data will still occupy the disk space. The only thing I've seen to clear this is a reboot.
As others said, a core file is a good candidate and what were your users doing over that time? Some times they do not realize they did it and many times they will not admit it. It's fun.

[Tim Malnati]

It would really help us to help you if you were to identify which file system you experienced this problem with (syslog should note it). If the file system is a typical data area, identifying the what is being used for will help figure out what is happening here.

[Eliane Maria Lui_1]

Hi Jennifer,

You can put this command ( find / -name core -exec rm {} ; ) to run in the cron.

Rgds,

Eliane

[Eliane Maria Lui_1]

Hi ,

There are some file you can empty with the command:
$ > file_of_log
The file are:
/var/adm/wtmp
/var/adm/btmp
/var/adm/sulog
/var/adm/cron/log
/var/spool/mqueue/syslog
/var/spool/mqueue/sendmail.st
/var/spool/uucp/.Admin/*
/usr/spool/uucp/.Log/*
/var/adm/lp/log
/var/adm/messages
/var/adm/sw/swinstalllog
/var/adm/sw/swremove.log
/var/adm/sw/sw*.log

You can use the cron to do this.

Rgds.
Eliane

[Eliane Maria Lui_1]

Hi Jennifer,

You can put this command in the cron: find / -name core -exec rm {} ;

I hope it help you,

Eliane

[Manju Kampli]

this could be due to some large file trying to write to a file system which can not accomadate and hence the write operation failed causing the deletion of already written portion of the file. If the file is 1GB large and file system has gor only 500KB space, the file will be written upto 500KB and when it finds the file system is full, the OS will report the error and logs into /var/adm/syslog/syslog.log and deletes the 500KB file which has already written to the file system leaving the file system in to its original state. the user/process which has initiated this write operation will get a error