Re: NAT and var/log

From: James Wyatt (jwyatt_at_RWSystems.net)
Date: 01/23/04

  • Next message: Troy Settle: "VOIP/Asterisk/Zaptel hardware for *BSD" 
    Date: Fri, 23 Jan 2004 12:17:51 -0600 (CST)
To: Lewis Watson <lists@visionsix.com>

    Sorry to follow-up on my own post, but it's "du -kx", not "-kv". The "x"
    prevents du from wandering into subordinate filesystems mounted under
    /var/, if you care to know. It can be very handy to mount /var/log/ in
    append-only mode so the logfiles can't be edited... Thanks - Jy@

    On Fri, 23 Jan 2004, James Wyatt wrote:
    > There are a number of things under /var that can fill it up: /var/log,
    > /var/mail, /var/run, /var/tmp. Common things that fill up are large user
    > mailboxes, folks using vi to edit/view a large file, and log files that
    > are deleted while still open. (Other reasons as well, but these are most.)
    >
    > Try doing a "du -kv /var/" and seeing if the total matches what shows as
    > "used" on a "df -k /var/". If there is a large difference, then someone
    > has likely deleted a file that is still open - usually by syslog. You can
    > restart syslog "kill -hup `cat /var/run/syslog.pid`" and see if that
    > helps. If that doesn't work and you can't find who has the file open, you
    > will likely have to reboot. (And educate an admin or user...)
    >
    > If there is no large difference between what du tells you is used by files
    > it can see and df shows the disk has used, then you can look for large
    > files with something like "find /var/ -type f -size +1000 -print". I would
    > look in /var/mail/ and /var/log/ first...
    >
    > If it comes and goes, then it's likely a user that needs to learn "more"
    > and that vi (some versions) keep temp files unless they use read-only mode
    > like "vi -r <file>". No doubt others can offer even better advice - this
    > is a great list in terms of real experience... (^_^)
    >
    > Hope this helps - Jy@
    >
    > On Fri, 23 Jan 2004, Lewis Watson wrote:
    > > Hi there,
    > > We recently set up a FreeBsd firewall/ router for a client and /var is
    > > getting pretty full. Is there a table or log somewhere in /var that is
    > > filling up? I looked in /var/log and there is nothing here that is out of
    > > the ordinary. I would appreciate any pointers here.
    > > Thanks.
    > > Lewis
    > >
    > > _______________________________________________
    > > freebsd-isp@freebsd.org mailing list
    > > http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    > > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"

    _______________________________________________
    freebsd-isp@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"

  • Next message: Troy Settle: "VOIP/Asterisk/Zaptel hardware for *BSD"