Re: NAT and var/log

From: James Wyatt (jwyatt_at_RWSystems.net)
Date: 01/23/04

  • Next message: James Wyatt: "Re: NAT and var/log" 
    Date: Fri, 23 Jan 2004 12:01:31 -0600 (CST)
To: Lewis Watson <lists@visionsix.com>

    There are a number of things under /var that can fill it up: /var/log,
    /var/mail, /var/run, /var/tmp. Common things that fill up are large user
    mailboxes, folks using vi to edit/view a large file, and log files that
    are deleted while still open. (Other reasons as well, but these are most.)

    Try doing a "du -kv /var/" and seeing if the total matches what shows as
    "used" on a "df -k /var/". If there is a large difference, then someone
    has likely deleted a file that is still open - usually by syslog. You can
    restart syslog "kill -hup `cat /var/run/syslog.pid`" and see if that
    helps. If that doesn't work and you can't find who has the file open, you
    will likely have to reboot. (And educate an admin or user...)

    If there is no large difference between what du tells you is used by files
    it can see and df shows the disk has used, then you can look for large
    files with something like "find /var/ -type f -size +1000 -print". I would
    look in /var/mail/ and /var/log/ first...

    If it comes and goes, then it's likely a user that needs to learn "more"
    and that vi (some versions) keep temp files unless they use read-only mode
    like "vi -r <file>". No doubt others can offer even better advice - this
    is a great list in terms of real experience... (^_^)

    Hope this helps - Jy@

    On Fri, 23 Jan 2004, Lewis Watson wrote:
    > Hi there,
    > We recently set up a FreeBsd firewall/ router for a client and /var is
    > getting pretty full. Is there a table or log somewhere in /var that is
    > filling up? I looked in /var/log and there is nothing here that is out of
    > the ordinary. I would appreciate any pointers here.
    > Thanks.
    > Lewis
    >
    > _______________________________________________
    > freebsd-isp@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
    >

    _______________________________________________
    freebsd-isp@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"

  • Next message: James Wyatt: "Re: NAT and var/log"

    Relevant Pages

    • Re: Update settings overriden, again
      ... I agree, that the log files tell you afterwards but the issue for some of the folks seems to have been that they had MU set and its still overrode, so we need to wait and see. ... Every time I patch I choose MU, custom install and I LOOK at what is being installed and I've not seen anything I've not expected. ... Microsoft needs to start telling each user exactly what they are installing at each update cycle BEFORE the cycle starts, ...
      (microsoft.public.windowsupdate)
    • logcheck error on breezy
      ... Folks! ... I get this error on the report emailed to me by logcheck: ... Warning: If you are seeing this message, your log files may not have been ...
      (Ubuntu)