sh[2]: spu0.log: Cannot create the specified file

[aamir4u]

Hi,

My /var filsysem is 95%

when i clear /var/.audit logs

some logs clear and some  latest logs not clear.Its generated message.

For example:-----

prodata1#pwd
/var/.audit/audtrail.20111230_0118
prodata1#
prodata1#ll
total 25352208
-rw-------   1 root       root       12979435896 Feb 28 15:03 spu0.log
prodata1#
prodata1#> spu0.log
sh[2]: spu0.log: Cannot create the specified file.
prodata1#

Please suggest me .how can clear the message

thanks

aaamir

[VK2COT]

Hello,

a) What does this command show currently:

# getacl spu0.log

It looks like the audit trail is locked and does not allow other process to remove the record in it.

b) Also, how does the auditing look:

# audsys

If you can afford it, you can alwsy stop ther auditing for a second and remove/move the file then.

Cheers,

VK2COT

[Dennis Handly]

>spu0.log: Cannot create the specified file.

I assume you are root?  And /var/.audit/audtrail.20111230_0118/ isn't over NFS?

What does "bdf /var/.audit/audtrail.20111230_0118" show?

[aamir4u]

Hi,

prodata1#bdf /var/.audit/audtrail.20111230_0118
Filesystem          kbytes    used   avail %used Mounted on
/dev/vg00/lvol8    41943040 41150720  792008   98% /var

One another question is my server /var/.ayudit has many directories

and i want do clear or delete logs under that directories or sub-directories

is any command to clears logs under .audit directory any sub-directory

(because .audits directory have 3000 thousand directory.On that directory have spu0.log file.and

i clear logs one by one .its take lot of time)

Please suggest me any shortcuts.to clear all logs.

thanks

[Dennis Handly]

>Please suggest me any shortcuts to clear all logs.

You can always do rm -rf.

And if too many, you can script it with find.

How many do you want to keep.  How many to delete?

[aamir4u]

Thanks for advice.

I want to delete 2000 directories.

But one thing

when we clear logs

Example:---------

> /var/.audit/audtrail.20111230_0118/spu0.log

its clears the file content not delete the file or dir.

Is any shortcut process to clear the 2000 files content unde /var/.audit/sub-dir-name/spu0.log (not one by one)

if any process to tell me.otherwise,

tell me rm -rf delete process.

Thanks for advanced.

[Dennis Handly]

>Is any shortcut process to clear the 2000 files content under /var/.audit/sub-dir-name/spu0.log (not one by one)

Sure, you write a script:

for log in /var/.audit/*/spu0.log; do

   > $log

done

[aamir4u]

hi,

thaks for great answer.

[Dennis Handly]

>thanks for great answer.

If you are happy, please click on the kudos star for each post that was helpful.