SUMMARY: /var Size

From: lkim@dkb.com
Date: Tue Jul 27 1999 - 16:49:39 CDT


Thanks to:
Eugine, Choi
Gwendolyn ferch Elydyr
Larry Chin
Kruse, Jason
Jonathan Loh
Kevin Prigge
Paramasivam Meenakshisundaram
Mahesh Reddy
Callum Finlayson
Barry Gamblin
Frank Smith
Jay Morgan
Kevin Korb

and to those who responded later.

The most common response was that a file was deleted when a process still had
the file open. In this case either du or ls will not show the space or the name
properly. Only way to get rid of the file is to kill the process or find the
file by 'lsof' or 'fuser -c /var' and get rid of it. One person mentioned that
find the inode of the file and use 'clri' to get rid of the file or the inode.

(lsof can be retrieved at ftp.sunet.se:/pub/unix/admin/lsof )

Another way to reclaim the space is to find the file name and cat /dev/null >
'filename' . This zeros out the size of the file.

Someone one else mentioned that fsck may do the trick.

Anyway, when it happens again, I will try to find the open file and get rid of
it. Then I post the result.

<ORIGINAL QUESTION>

Dear Sun Managers;

Strange problem:

One day last week, our /var had 100% capacity, so we did the usuals: looking
into various log files, messages files and so forth. We found out none of these
really increased much from the day before. The capacity was 24% use the day
before. We ended up adding file sizes under /var and du -kd /var to confirm the
result, and surprisingly there were only approx. 100MB of files out of 300MB
allocated for the /var partition.
Since we were doing a maintenance work that night, we had to reboot the system,
and /var went back to 24%.

Does anyone have any clue?

Information:
OS: Solaris 2.5.1
HW: E4000
A5000 Storage array with Veritas VM 2.5

Thanks,

LK+



This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:13:24 CDT