[BlueOnyx:04774] Re: /var directory full
Chuck Tetlow
chuck at tetlow.net
Fri Jun 18 19:44:08 -05 2010
---------- Original Message -----------
From: "Luis Rojas" <Luis at avalonglobal.com>
To: <blueonyx at blueonyx.it>
Sent: Fri, 18 Jun 2010 10:37:40 -0600
Subject: [BlueOnyx:04770] /var directory full
> Hey Guys,
>
> This morning I notice that my /var directory is full, I figureit was probably logs, but I am not sure which ones to delete. Or is there a wayto increase the size of my /var directory?
> This is what the logs look like:
>
>
> Server /var/log# ls -l
> total 1119160
> drwx------ 2 root root 4096 Jun 13 05:05 admserv
> drwxr-x--- 2 root root 4096 Jun 3 00:25 audit
> -rw------- 1 root root 0 Jun 13 05:21boot.log
> -rw------- 1 root root 20 Jun 13 05:22boot.log.1.gz
> -rw------- 1 root root 0 Oct 18 2009 boot.log.2
> -rw------- 1 root root 20 Jun 6 05:04boot.log.2.gz
> -rw------- 1 root root 0 Oct 11 2009 boot.log.3
> -rw------- 1 root root 20 May 30 04:24boot.log.3.gz
> -rw------- 1 root root 0Oct 4 2009 boot.log.4
> -rw------- 1 root root 20 May 24 04:31boot.log.4.gz
> -rw------- 1 root utmp 811817472 Jun 1809:20 btmp
> -rw------- 1 root root 2013871 Jun 18 10:10 cron
> -rw------- 1 root root 147764 Jun 13 05:22 cron.1.gz
> -rw------- 1 root root 457608 Oct 25 2009 cron.2
> -rw------- 1 root root 148008 Jun 6 05:04 cron.2.gz
> -rw------- 1 root root 457636 Oct 18 2009 cron.3
> -rw------- 1 root root 73496 May 30 04:24 cron.3.gz
> -rw------- 1 root root 457335 Oct 11 2009 cron.4
> -rw------- 1 root root 34021 May 24 04:31 cron.4.gz
> -rw-r--r-- 1 root root 17658 May 17 16:15 dmesg
> -rw------- 1 root root 15672 Jun 14 09:14 faillog
> drwxr-xr-x 3 root root 4096 Jun 18 05:20 httpd
> -rw-r--r-- 1 root root 14194 Jun 18 10:01 ipacct
> -rw-r--r-- 1 root root 5951 Jun 18 05:20 ipacct.1.gz
> -rw-r--r-- 1 root root 38992 Nov 4 2009 ipacct.2
> -rw-r--r-- 1 root root 5952 Jun 17 05:21 ipacct.2.gz
> -rw-r--r-- 1 root root 39076 Nov 3 2009 ipacct.3
> -rw-r--r-- 1 root root 6005 Jun 16 05:22 ipacct.3.gz
> -rw-r--r-- 1 root root 38999 Nov 2 2009 ipacct.4
> -rw-r--r-- 1 root root 6288 Jun 15 05:34 ipacct.4.gz
> -rw-r--r-- 1 root root 190676 Jun 18 10:03 lastlog
> drwxr-xr-x 2 root root 4096 Mar 9 2009 mail
> -rw------- 1 root root 775045 Jun 18 10:10 maillog
> -rw------- 1 root root 241370 Jun 18 05:20 maillog.1.gz
> -rw------- 1 root root 101502 Nov 4 2009 maillog.2
> -rw------- 1 root root 268293 Jun 17 05:21 maillog.2.gz
> -rw------- 1 root root 92168 Nov 3 2009 maillog.3
> -rw------- 1 root root 245726 Jun 16 05:22 maillog.3.gz
> -rw------- 1 root root 72906 Nov 2 2009 maillog.4
> -rw------- 1 root root 254089 Jun 15 05:34 maillog.4.gz
> -rw------- 1 root root 61932114Jun 18 10:10 messages
> -rw------- 1 root root 2592020 Jun 13 05:22 messages.1.gz
> -rw------- 1 root root 22568557Oct 25 2009 messages.2
> -rw------- 1 root root 3952620 Jun 6 05:04 messages.2.gz
> -rw------- 1 root root 23817327Oct 18 2009 messages.3
> -rw------- 1 root root 2465707 May 30 04:24 messages.3.gz
> -rw------- 1 root root 26491901Oct 11 2009 messages.4
> -rw------- 1 root root 2438441 May 24 04:31 messages.4.gz
> -rw------- 1 root root 279491 Sep 16 2009 messages.save
> -rw------- 1 root root 12107705Sep 16 2009 messages.save.1
> -rw-r----- 1 mysql mysql 21534 May 17 16:16 mysqld.log
> -rw-r--r-- 1 apacheapache 0 Feb 16 13:08 php_error
> drwxr-xr-x 2 root root 4096 Apr 2 2009 pm
> drwxr-xr-x 2 root root 4096 Jan 20 2009 prelink
> drwxr-x--- 2 root root 4096 Jun 13 05:21 proftpd
> -rw-r--r-- 1 root root 33812 Jun 18 05:21 rpmpkgs
> -rw-r--r-- 1 root root 7792 Jun 13 05:21 rpmpkgs.1.gz
> -rw-r--r-- 1 root root 31498 Oct 24 2009 rpmpkgs.2
> -rw-r--r-- 1 root root 7729 Jun 6 05:04rpmpkgs.2.gz
> -rw-r--r-- 1 root root 31498 Oct 17 2009 rpmpkgs.3
> -rw-r--r-- 1 root root 7729 May 30 04:24 rpmpkgs.3.gz
> -rw-r--r-- 1 root root 31498 Oct 10 2009 rpmpkgs.4
> -rw-r--r-- 1 root root 7729 May 24 04:31 rpmpkgs.4.gz
> -rw------- 1 root root 110738288 Jun 1810:06 secure
> -rw------- 1 root root 1285815 Jun 13 05:22 secure.1.gz
> -rw------- 1 root root 3015640 Oct 25 2009 secure.2
> -rw------- 1 root root 5805808 Jun 6 05:04 secure.2.gz
> -rw------- 1 root root 29141757 Oct17 2009 secure.3
> -rw------- 1 root root 1582303 May 30 04:24 secure.3.gz
> -rw------- 1 root root 12817318Oct 10 2009 secure.4
> -rw------- 1 root root 3188035 May 24 04:31 secure.4.gz
> -rw------- 1 root root 0 Jun 13 05:21spooler
> -rw------- 1 root root 20 Jun 13 05:22spooler.1.gz
> -rw------- 1 root root 0 Oct 18 2009 spooler.2
> -rw------- 1 root root 20 Jun 6 05:04spooler.2.gz
> -rw------- 1 root root 0 Oct 11 2009 spooler.3
> -rw------- 1 root root 20 May 30 04:24spooler.3.gz
> -rw------- 1 root root 0 Oct 4 2009 spooler.4
> -rw------- 1 root root 20 May 24 04:31spooler.4.gz
> -rw-r--r-- 1 root root 0 Oct 7 2009 syslog
> -rw------- 1 root root 0 Apr 2 2009 tallylog
> drwxr-xr-x 2 tomcat tomcat 4096Mar 10 2009 tomcat5
> -rw-rw-r-- 1 root utmp 154368 Jun 18 10:03 wtmp
> -rw-rw-r-- 1 root utmp 42484 May 7 04:23 wtmp.1.gz
> -rw-r--r-- 1 root root 0 Jun 18 05:20xferlog
> -rw-r--r-- 1 root root 20 Jun 18 05:20xferlog.1.gz
> -rw-r--r-- 1 root root 20 Jun 17 05:21xferlog.2.gz
> -rw-r--r-- 1 root root 20 Jun 16 05:22xferlog.3.gz
> -rw-r--r-- 1 root root 20 Jun 15 05:34xferlog.4.gz
> -rw-r--r-- 1 root root 2169 Jun 18 06:00 yum.log
> -rw-r--r-- 1 root root 4275 Jan 1 04:39yum.log.1.gz
> -rw-r--r-- 1 root root 1840 Nov 5 2009yum.log.2009-11-05
>
> Thanks for the help.
>
> -Luis
------- End of Original Message -------
Hi Luis,
Sure - it appears you have some largish log files. But the biggest I see are the secure file at 110Meg and the messages file at 62Meg. Everything I see on that list probably won't add up to more than 1Gig. Since most servers have about 4Gig for /var - that's probably not the problem. (Although deleting the older files with "rm -f /var/log/*.gz" would definitely help)
You might check out the httpd directory under /var/log. That's the Apache webserver logs directory. And I've seen a persistent PHP script error fill that /var partition with errors in the /var/log/httpd/error.log file. If that isn't the problem - here's how you find it.
Go into the /var partition. After looking at the list of files with "ls -lh" - you may be able to spot the problem. The "h" switch gives you "human" readable size output (kilobytes, megabytes, gigabytes). But if the files eating up the partiation are in a directory instead of /var - use "du -hs *" to look at the sizes of the files AND directories. This output is also in human readable size output.
With that output, you should be able to spot what directory is using up so much of the space on that partition. When you find the directory - go into it and use the command again. The "du -hs *" command is very helpful in tracking down what's screwing up and eating up drive space.
Once you find it - delete anything you can. If its older log files in /var/log/httpd, just delete anything named .gz. If its mail spool files stuck unable to send in the /var/spool/mqueue - delete them. (I one time found a server that had been running for a year and a half that had 57,000+ files in that directory!) If its incoming SPAM and other undeliverable e-mail, they may be stuck in the /var/spool/mail, /var/spool/mqueue.in, or /var/spool/MailScanner/quarantine directories. Again - delete anything eating up excessive space in those directories.
Good luck.
Chuck
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.blueonyx.it/pipermail/blueonyx/attachments/20100618/fe5481e5/attachment.html>
More information about the Blueonyx
mailing list