bdf shows same value after deleting stuff in /var

[NDO]

Hi All

something unusual is occurring since two weeks ago I´ve beed deleting big files in /var/spool/cron/tmp but I can only see the efect of using "rm" when rebooting the server.
Please can somebody explain to me why, why this big files are all of sudden there. I appreciate your help on this.
Although I pass the CSA exame I dont have a lot of experience on the field, so please help if you can.

regards

F.R.

[vishnu.khandare]

Hi Nandinho,

Have u deleted the big files before?
Please check the syslog.
Please check whether u have deleted the correct file?
have u tried to delete the files by rm -rf?
If not please check this.

Hope this solves ur issue
Dont forget to assign points

Regards
Vishnu Khandare

[NDO]

Hi!

I´ve beed deleting file by file, e.g. ( rm croutHLAa01568 ). There is no reference in syslog.log

note: I always assign points when posting queries on the forum.

regards

F.R.

[Duncan Edmonstone]

You have no doubt deleted (a) file(s) that some process(es) still had open...

Your challenge now is to try and identify those processes and stop them if you are able or it is sensible to do so. The easiest way to do that is to get hold of a copy of lsof if you don't have it already:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.84/

You can then run:

lsof +aL1 /filesystem

To find all "unlinked" files on the filesystem which are still open, and the processes holding them open..

HTH

Duncan

[ani007]

Try to use the find command to search the big files.

#cd /var
#find . -xdev -size +10000 -exec ls -lrt {} \;

before deleting the file check the timestamp
#ll
remove the file. If you see that again the file is there then check the time stamp. May be after deletion again its created automatically. so please check the timestamp before &after deletion.

[ani007]

MR Duncan is right may be you have deleted but due to open files it can happen ,as he suggest pls use lsof.Thank you Ducan

[NDO]

Hi
I´ve used the lsof, this is the output of the command:

/usr/local/bin #./lsof +aL1 /var
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
sh 699 ora10g 1w REG 64,0xa 586861075 0 9780 /var (/dev/vg00/lvol10)
sh 699 ora10g 2w REG 64,0xa 586861075 0 9780 /var (/dev/vg00/lvol10)
sh 703 ora10g 1w REG 64,0xa 586861075 0 9780 /var (/dev/vg00/lvol10)
sh 703 ora10g 2w REG 64,0xa 586861075 0 9780 /var (/dev/vg00/lvol10)
sh 744 ora10g 1w REG 64,0xa 586936815 0 8460 /var (/dev/vg00/lvol10)
sh 744 ora10g 2w REG 64,0xa 586936815 0 8460 /var (/dev/vg00/lvol10)
sshd 916 root 3u unix 64,0xa 0t0 0 4099 /var/spool/sockets/pwgr/client915 (0xbc6173c0)
lpsched 1560 lp 3u unix 64,0xa 0t0 0 4137 /var/spool/sockets/pwgr/client1557 (0xbf6c8c80)
swagentd 1722 root 5u REG 64,0xa 60 0 7327 /var (/dev/vg00/lvol10)
sh 5277 ora10g 1w REG 64,0xa 586861075 0 9780 /var (/dev/vg00/lvol10)
sh 5277 ora10g 2w REG 64,0xa 586861075 0 9780 /var (/dev/vg00/lvol10)
sh 7597 ora10g 1w REG 64,0xa 586897644 0 9090 /var (/dev/vg00/lvol10)
sh 7597 ora10g 2w REG 64,0xa 586897644 0 9090 /var (/dev/vg00/lvol10)
sh 7605 ora10g 1w REG 64,0xa 586897644 0 9090 /var (/dev/vg00/lvol10)
sh 7605 ora10g 2w REG 64,0xa 586897644 0 9090 /var (/dev/vg00/lvol10)
sh 9460 ora10g 1w REG 64,0xa 570483566 0 9355 /var (/dev/vg00/lvol10)
sh 9460 ora10g 2w REG 64,0xa 570483566 0 9355 /var (/dev/vg00/lvol10)
sh 9464 ora10g 1w REG 64,0xa 570483566 0 9355 /var (/dev/vg00/lvol10)
sh 9464 ora10g 2w REG 64,0xa 570483566 0 9355 /var (/dev/vg00/lvol10)
sh 10365 ora10g 1w REG 64,0xa 570483566 0 9355 /var (/dev/vg00/lvol10)
sh 10365 ora10g 2w REG 64,0xa 570483566 0 9355 /var (/dev/vg00/lvol10)
sh 11330 ora10g 1w REG 64,0xa 586897644 0 9090 /var (/dev/vg00/lvol10)
sh 11330 ora10g 2w REG 64,0xa 586897644 0 9090 /var (/dev/vg00/lvol10)
bch 16750 bscsprod 3u REG 64,0xa 4418 0 9473 /var (/dev/vg00/lvol10)
bch 16752 bscsprod 3u REG 64,0xa 4418 0 9541 /var (/dev/vg00/lvol10)
ftp 17820 ora10g 0u REG 64,0xa 209 0 10302 /var (/dev/vg00/lvol10)
ftp 17820 ora10g 2w REG 64,0xa 570483566 0 9355 /var (/dev/vg00/lvol10)
ftp 17824 ora10g 0u REG 64,0xa 119 0 10298 /var (/dev/vg00/lvol10)
ftp 17824 ora10g 2w REG 64,0xa 586861075 0 9780 /var (/dev/vg00/lvol10)
ftp 17829 ora10g 0u REG 64,0xa 209 0 7714 /var (/dev/vg00/lvol10)
ftp 17836 ora10g 0u REG 64,0xa 119 0 8583 /var (/dev/vg00/lvol10)
ftp 17836 ora10g 2w REG 64,0xa 586897644 0 9090 /var (/dev/vg00/lvol10)
ftp 17840 ora10g 0u REG 64,0xa 209 0 9144 /var (/dev/vg00/lvol10)
ftp 17847 ora10g 0u REG 64,0xa 119 0 7611 /var (/dev/vg00/lvol10)
ftp 17847 ora10g 2w REG 64,0xa 586936815 0 8460 /var (/dev/vg00/lvol10)
sh 28456 ora10g 1w REG 64,0xa 586936815 0 8460 /var (/dev/vg00/lvol10)
sh 28456 ora10g 2w REG 64,0xa 586936815 0 8460 /var (/dev/vg00/lvol10)
sh 28461 ora10g 1w REG 64,0xa 586936815 0 8460 /var (/dev/vg00/lvol10)
sh 28461 ora10g 2w REG 64,0xa 586936815 0 8460 /var (/dev/vg00/lvol10)


Would be right to say that the files that I deleted are related to:


sshd 916 root 3u unix 64,0xa 0t0 0 4099 /var/spool/sockets/pwgr/client915 (0xbc6173c0)
lpsched 1560 lp 3u unix 64,0xa 0t0 0 4137 /var/spool/sockets/pwgr/client1557 (0xbf6c8c80)


So what will be the next step?

Regards

R.R.

[NDO]

Hi

I´ve read on another post in the forum that files with link counts = 0 (NKINK) they will be ones that are still in use by a process and are thus holding disk space. If this is correct all those processes shown by lsof command must be killed?
Am I right? Please help

regards

F.R.

[Dennis Handly · Accepted solution]

>If this is correct all those processes shown by lsof command must be killed?

Well, only the ones with large files.
You'll have to determine whether the space is more important than the process.

You seem to have a lot of process by ora10g referencing these large stdout files:
586861075 0 9780
586936815 0 8460
586897644 0 9090
570483566 0 9355

>Would be right to say that the files that I deleted are related to:

Not really. Those seem to be sockets?

[NDO]

Hi Dennis!

Space is more important, so I´ve killed just one, the biggest, but still when I do bdf it shows /var as 97% as it was before.

I´ve used "kill PID number" to kill the process.

I need that space to go down up to 70%,


Regards

Fernando