HELP - /var filling up

[Tison]

our /var directory is filling up and we cannot find out why.
We have looked at all the normal log files and it is not there.
The filesystem seems to be growing but does not shrink when we delete a file.
Does anyone have an IBM AIX site that we can post this question to ?

 

[aixmurderer]

Look at your mail and print queues, they spool here.

to check sendmail queue - mailq
printer queues - lpstat (I think)

Also look at the wtmp & sulog files in /var/adm, they tend to grow. You can empty it by doing this command ">wtmp". Be careful not to delete them.

IBM Certified Confused - MQSeries
IBM Certified Flabbergasted - AIX 5 pSeries System Administration
MS Certified Windblows Rebooter

 

[aixmurderer]

Just thought of something else. cd to /var and run the "du" command. That will show you a byte count of all the subdirs in /var, a quick indication of where the culprits are.

IBM Certified Confused - MQSeries
IBM Certified Flabbergasted - AIX 5 pSeries System Administration
MS Certified Windblows Rebooter

 

[KenCunningham]

If, as you seem to say, the filesystem is growing but doesn't shrink when you delete a file, it's possible that some rogue (assuming this isn't a normal activity of your system) process is creating files and holding on to the space they take up even after they are nominally deleted. Is there anything odd in a ps -ef listing? A fuser /var might also give you a clue which users are using /var.

HTH.

 

[MoshiachNow]

Also,

/var/adm/ras - this is where the large vmcore.X (system dump) files reside.
You can delete them.

Or use the following to find 10 top files bigger then 10 MB on /var FS:
find /var -xdev -size +20480 -ls|sort -r +6|head -10


"Long live king Moshiach !"

http://www.7for70.com/

 

[BFOJ]

I've had situations where deleting files did not free up space UNTIL after rebooting.

 

[theycallmetim]

After booting just means that the process using the file is still running.

run fuser on the files first. See what has hold of them.

 

[Yegolev]

just fyi...

du /var | sort -n

IBM Certified -- AIX 4.3 Obfuscation