Mqueue? Empty..But Still Large 3

[Germo]

Hi All,

I wonder if you can help me out on this one.

Our directory /var is currently at 87% full so I check to see whats in there, now in the directory /var/spool there is a directory called mqueue and it size is 1850880 (shown from the output of ls -l), I check in this directory and there are only three very small files...

Can anyone explain why the directory reads so large yet there isn't anything major in it? How do I get the mqueue directory to show the actual size of its content.

Thanks

 

[hirschaj]

Maybe sendmail still has a file open that was deleted. Try a stop/start on the sendmail daemon then see if the space was released.


Jim Hirschauer

http://www.aixexpert.com

 

[p5wizard]

If a directory was at some point in time "overflowing" with files, the dir needed to grow to hold all the file names and inode numbers. If since then, the files are deleted, the dir still keeps its max size it once had.

Only way to get rid of this is stop sendmail daemon, backup, rm -r and restore of /var/spool/mqueue.

Granted, it is 1.8MB, but that alone should not account for the 85%... I'd go look further.


HTH,

p5wizard

 

[Germo]

pwizard,

You are right, it isn't the mqueue directory that has filled the /var filesystem it is our /var/adm/wtmp which is currently at 216932352 in size, the wtmp file is a file that has had me all confused before, can I simply >wtmp the file, or make a saved copy of it or do I have to only delete a few entries. I also have my boss saying that we can't simply deleted or clear out the wtmp file as it holds all the users login active.

 

[KenCunningham]

It does, but you could copy it to tape and then do a:

cat /dev/null > wtmp to recreate it as an empty file. This will of course, mean that last will show only those details since the zeroing unless you restore the old wtmp file.

 

[p5wizard]

The file wtmp stores system events like user login, user logout, ftp session start/end and more. Also since AIX53: rsh start/end. You can zeroise it without harm. The file that holds info for current sessions is utmp if I am not mistaken.

You can use the command nulladm to create a new wtmp file with the right ownership and permissions.

See also the man page for fwtmp. I use nulladm and fwtmp to divide the wtmp file in wtmp.$(date) parts and keep about 2 weeks of info.




HTH,

p5wizard

 

[Germo]

Thanks,

With the wtmp file when zeroing it out via nulladm does the newly created wtmp have to have a special header or is that only with the utmp file?

Thanks

 

[KenCunningham]

I would imagine that nulladm, being part of the OS, would do whatever is necessary. In the meantime, a star to p5wizard for bringing it to my attention.

 

[p5wizard]

The file wtmp doesn't have a special header AFAK. Just binary data.

The nulladm command (/usr/sbin/acct/nulladm) is a shell script - you can check it out for yourself.

All the command does is cp /dev/null to the file (ANY FILE!!!) specified, chown and chmod. But it isn't foolproof - it is not limited to allow only zeroising accounting files, so use with care. Perhaps that's why /usr/sbin/acct is not in $PATH...


HTH,

p5wizard

 

[Germo]

Thanks very much p5wizard.