/var is the fastest growing filesystem in HP-UX and requires constant monitoring and maintenance. The output from lsof is not useful because it does not indicate the size of the directories. Use this command:
# du -kx /var | sort -rn | head -20
Now you can see where the space is being allocated. You might have /var/spool/lp very large due to printer probelms. Or /var/mail might be very large due to mail messages. Most of the system logfiles are kept in /var/adm/. You need to find the biggest directories first, then look at the files in those directories. You may find that frmweb is not the problem at all.
Before making any changes, run a backup of vg00. Then start by looking at /var/adm and /var/adm/syslog to see if you have extremely large (dozens of MB) logfiles. Use the command:
# ll /var/adm | sortk -rnk5 | head 20
You need to decide how to trim those big files. Don't remove them! Many are required for proper operation of the system and require specific permissions and ownership. Instead, make a copy of the current file (/tmp is a possible location) and then truncate the file using something like this:
# bdf /var
# cp /var/adm/syslog/syslog.log /tmp/syslog.log.2009-10-02
# cat /dev/null > /var/adm/syslog/syslog.log
Now you will have recovered some space in /var:
# bdf /var
Most production systems have auditing requirements to keep system logfiles for a year or more so compress the old log:
# compress /tmp/syslog.log.2009-10-02
And this will reduce the size of the old log. Then move the compressed file back to /var/adm/syslog. The reason is that /tmp may be erased during a bootup and you want all the related log files in the same directory:
# mv /tmp/syslog.log.2009-10-02 /var/adm/syslog
Repeat the cp/cat/compress/mv commands for other big logfiles.
You may find that /var/aadm/sw is quite large (from the previous du command). Use the cleanup command to commit old patches that have been superseded several times. A good starting point is:
# cleanup -c 2
This will remove archive information about patches that have been replaced (superseded) more than 2 times.
There are other directories in /var that may require work. Use the du listing above to determine where the most space is being used. For help cleaning up /var, post a listing of the above du command and we can suggest fixes for the space. Note that maintaining free space on /var, /tmp, /usr and / are some of the most important tasks for a system administrator. Oracle will shutdown (sometimes with errors) when certain filesystems fill up.
Bill Hassell, sysadmin
