Strange /var Action

[Germo]

On one of our servers (running AIX5.2) /var got to 90% full.

A quick investigation reveiled a file: /var/adm/cron/log
that was 107Mb in size

root:
> --> ls -l
> total 211429
> -rw-r----- 1 bin cron 4 Feb 27 2004 at.deny
> -rw-r----- 1 bin cron 3 Sep 16 2002 cron.deny
> prw------- 1 root cron 0 Sep 22 17:05 FIFO
> -rw-rw-r-- 1 bin bin 107644895 Sep 23 16:08 log
> -rw-r--r-- 1 root system 598066 Sep 23 16:07 log2
> -rw-r--r-- 1 root sys 1317 Sep 13 2002 queuedefs

It looks like it tracks the start and completion of all Cron jobs (any user).
But I can't find what is creating the file, but suspect it must be some sort of auditing.
The same file exists on another of our servers (AIX 4.3.3) but is very small.
I've tried copying the last 100,000 lines from the file into another,
removing the original file and renaming the second to that of the old.
Unfortunately the system doesn't like this and the %used value remains the same.

In fact, on deleting the original file (leaving only the new file) the
/var went to 94% used!
I had to blank the log file with, " > log" to get the FS to shrink back to 90%!
A restart of the server was then done and the FS dropped to
9%!!!!!!!!!!!!!!!!!!!

Is there a way to clearout /var without a reboot of the server, plus have any of you had a simliar situation?

Thanks

 

[hirschaj]

What you ran into is quite common. the cron daemon logs to that file. When you removed the log file the daemon was still running and therefore using the log file. The space will not get released until the cron process actually releases the file (your reboot took care of that). You sould have just stopped and restarted the cron daemon. In the future before you remove a file you should just zero it. This will assure that you don't bump into the same problem.


Jim Hirschauer

http://www.aixexpert.com

 

[Germo]

Thank you very much hirschaj.