fs / and /var increasing always

[bonsky]

i just want to ask what could be the possbile procedure to check what file is continually increasing, any scripts that i can run or any file to observe this system?
My / and /var keeps increasing about 4k every 5 mins. we are currently running oracle, but we did not do any sort of scri[pt modifications with oracle.
Ialso check witth at, cron, inittab and theres no process running. But we can't figure it out which exact file that keeps growing ? is there a way?
thanks!

 

[KenCunningham]

Maybe you could do a find on the filesystems and look for files over a certain size for a period of 5-10 mins. Put this in your cron to run every minute and direct the output to a file so that you can examine what's happening. Something like find /var -size +500 -print >> bigfiles in your cron should give you an idea which files are growing. My guess is something like /var/adm/wtmp or similar. Let us know how you get on and post back if more info. is needed. Cheers.

 

[bonsky]

okay, thanks, ill try that one, but how about for my /, how come its also keeps on increasing. also, i have check on my wtmp, theres no much ppl logging in that fast, in and out.
ill let you know the results... thanks

 

[AIXSPadmin]

Do check your /dev/null file. It is supposed to be a character special file with major/minor numbers of 2,2. There have been problems with some maintenance releases of AIX where /dev/null gets created as a normal file; then whenever an app sends anything to /dev/null it is actually just doing an append to the file, thus increasing size.

Don't know if that is your problem, but it is worth checking. If it is your problem, correct it by doing the following like it is typed:

rm /dev/null; mknod /dev/null c 2 2; chmod 666 /dev/null

 

[Butterfly123]

Another sugegstion

smit.log file also increases fast.. Checkout where do u store that file.. Normally its stored on root partition by default..

Regds,

- Hemant

 

[bonsky]

AIXSPadmin,
the machine is 6H1 and running AIX4.3.3 with RML 7, we are not experiencing this before but how come recently all of a sudden, it keeps on growing. Sorry, but we dont know how to check wether this /dev/null is the file that is increasing.. if i do ls, it just prompt me 2, 2, something like special character and i dunno how to check if this is the thing that is giving us headache.
Also, if we remove this using the command you gave me, will this immediately affect some other apps, like ORACLE tht is pointing to this one?? what would be the possible affects to other apps, incase i remove and recreate it?
Thanks a lot!
I alreADY erase the smit.log as well..

 

[DSMARWAY]

if you are saying / & var increasing every 5 mins try this
create a file using touch (i.e. touch filename mmddhhmmyy )
this will create a file with time stamp , say 10:00 am for
today 9th july ) then find all files in / or /var that are newer than the timestamp of the file you created using touch command) )

find / -newer filename -xdev -type f -ls

in /dev should be device files that are character or block
device ( i.e. file perms with c or b at beggining ) any other file could indicate what AIXSPADMIN suggested
to find this out find all files in /dev directory which are files find /dev/ -type f -ls
Then you can decide whether to remove them or investigate whether application uses them )

If you don't have /dev/null listed as character device and is a file , you can remove it and re-add it without affecting anything as suggested by AIXSPADMIN

HTH

 

[MoshiachNow]

Also,

in the extreme case one case run trace+tracerpt and filter out all write events to "/" and "/var". "Long live king Moshiach !"
h

http://www.noahide.com/movement.htm

 

[AIXSPadmin]

cat /dev/null and if it returns anything, then you know that it is collecting everything sent to it instead of dumping it. A successful cat of /dev/null should just return you to a prompt. Also, do an ls -l of /dev/null and it should return:

/(x930)#ls -l /dev/null
crw-rw-rw- 1 root system 2, 2 Jul 09 0:26 /dev/null

If it returns something like the following:

f2n5ent: -rw-rw-rw- 1 root system 96 Jul 09 10:21 /dev/null
f2n9ent: -rw-rw-rw- 1 root system 0 Jul 09 10:27 /dev/null

Then you need to do the remove and recreation of /dev/null.