<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<font size="2"><b>---------- Original Message
-----------</b>
<br />
From: "Luis Rojas" <Luis@avalonglobal.com>
<br />
To: <blueonyx@blueonyx.it>
<br />
Sent: Fri, 18 Jun 2010 10:37:40 -0600
<br />
Subject: [BlueOnyx:04770] /var directory full
<br />
<br />> <span style="font-size: 10pt;">Hey
Guys,<o:p /></span>
<br />> <span style="font-size: 10pt;"><o:p>
</o:p></span>
<br />> <span style="font-size: 10pt;">This morning I notice that my /var directory is full, I
figure
it was probably logs, but I am not sure which ones to delete. Or is there a
way
to increase the size of my /var
directory?<o:p /></span>
<br />> <span style="font-size: 10pt;">This is what the logs look
like:<o:p /></span>
<br />> <span style="font-size: 10pt;"><o:p>
</o:p></span>
<br />> <span style="font-size: 10pt;"><o:p>
</o:p></span>
<br />> <span style="font-size: 10pt;">Server /var/log# ls
-l<o:p /></span>
<br />> <span style="font-size: 10pt;">total
1119160<o:p /></span>
<br />> <span style="font-size: 10pt;">drwx------ 2 root
root 4096 Jun 13 05:05
admserv<o:p /></span>
<br />> <span style="font-size: 10pt;">drwxr-x--- 2 root
root 4096 Jun 3 00:25
audit<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 0 Jun 13
05:21
boot.log<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 20 Jun 13
05:22
boot.log.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
0 Oct 18 2009
boot.log.2<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 20 Jun 6
05:04
boot.log.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 0 Oct 11
2009
boot.log.3<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 20 May 30
04:24
boot.log.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
0
Oct 4 2009
boot.log.4<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 20 May 24
04:31
boot.log.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root utmp 811817472 Jun
18
09:20
btmp<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
2013871 Jun 18 10:10
cron<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
147764 Jun 13 05:22
cron.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
457608 Oct 25 2009
cron.2<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
148008 Jun 6 05:04
cron.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
457636 Oct 18 2009
cron.3<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 73496 May 30 04:24
cron.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
457335 Oct 11 2009
cron.4<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 34021 May 24 04:31
cron.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 17658 May 17 16:15
dmesg<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 15672 Jun 14 09:14
faillog<o:p /></span>
<br />> <span style="font-size: 10pt;">drwxr-xr-x 3 root
root 4096 Jun 18 05:20
httpd<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 14194 Jun 18 10:01
ipacct<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 5951 Jun 18 05:20
ipacct.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 38992 Nov 4 2009
ipacct.2<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 5952 Jun 17 05:21
ipacct.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 39076 Nov 3 2009
ipacct.3<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 6005 Jun 16 05:22
ipacct.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 38999 Nov 2 2009
ipacct.4<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 6288 Jun 15 05:34
ipacct.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root root
190676 Jun 18 10:03
lastlog<o:p /></span>
<br />> <span style="font-size: 10pt;">drwxr-xr-x 2 root
root 4096 Mar 9 2009
mail<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
775045 Jun 18 10:10
maillog<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
241370 Jun 18 05:20
maillog.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
101502 Nov 4 2009
maillog.2<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
268293 Jun 17 05:21
maillog.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 92168 Nov 3 2009
maillog.3<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
245726 Jun 16 05:22
maillog.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 72906 Nov 2 2009
maillog.4<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
254089 Jun 15 05:34
maillog.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
61932114
Jun 18 10:10
messages<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
2592020 Jun 13 05:22
messages.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
22568557
Oct 25 2009
messages.2<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
3952620 Jun 6 05:04
messages.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
23817327
Oct 18 2009
messages.3<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
2465707 May 30 04:24
messages.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
26491901
Oct 11 2009
messages.4<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
2438441 May 24 04:31
messages.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
279491 Sep 16 2009
messages.save<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
12107705
Sep 16 2009
messages.save.1<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r----- 1 mysql mysql
21534 May 17 16:16
mysqld.log<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1
apache
apache 0 Feb 16 13:08
php_error<o:p /></span>
<br />> <span style="font-size: 10pt;">drwxr-xr-x 2 root
root 4096 Apr 2 2009
pm<o:p /></span>
<br />> <span style="font-size: 10pt;">drwxr-xr-x 2 root
root 4096 Jan 20 2009
prelink<o:p /></span>
<br />> <span style="font-size: 10pt;">drwxr-x--- 2 root
root 4096 Jun 13 05:21
proftpd<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 33812 Jun 18 05:21
rpmpkgs<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 7792 Jun 13 05:21
rpmpkgs.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 31498 Oct 24 2009
rpmpkgs.2<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 7729 Jun 6
05:04
rpmpkgs.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 31498 Oct 17 2009
rpmpkgs.3<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 7729 May 30 04:24
rpmpkgs.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 31498 Oct 10 2009
rpmpkgs.4<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 7729 May 24 04:31
rpmpkgs.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root 110738288 Jun
18
10:06
secure<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
1285815 Jun 13 05:22
secure.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
3015640 Oct 25 2009
secure.2<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
5805808 Jun 6 05:04
secure.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root 29141757
Oct
17 2009
secure.3<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
1582303 May 30 04:24
secure.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
12817318
Oct 10 2009
secure.4<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root root
3188035 May 24 04:31
secure.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 0 Jun 13
05:21
spooler<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 20 Jun 13
05:22
spooler.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 0 Oct 18
2009
spooler.2<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 20 Jun 6
05:04
spooler.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 0 Oct 11
2009
spooler.3<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 20 May 30
04:24
spooler.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 0 Oct
4 2009
spooler.4<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 20 May 24
04:31
spooler.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 0 Oct
7 2009
syslog<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw------- 1 root
root 0 Apr
2 2009
tallylog<o:p /></span>
<br />> <span style="font-size: 10pt;">drwxr-xr-x 2 tomcat tomcat
4096
Mar 10 2009
tomcat5<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-rw-r-- 1 root utmp
154368 Jun 18 10:03
wtmp<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-rw-r-- 1 root
utmp 42484 May 7 04:23
wtmp.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 0 Jun 18
05:20
xferlog<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 20 Jun 18
05:20
xferlog.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 20 Jun 17
05:21
xferlog.2.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 20 Jun 16
05:22
xferlog.3.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 20 Jun 15
05:34
xferlog.4.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 2169 Jun 18 06:00
yum.log<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 4275 Jan 1
04:39
yum.log.1.gz<o:p /></span>
<br />> <span style="font-size: 10pt;">-rw-r--r-- 1 root
root 1840 Nov 5
2009
yum.log.2009-11-05<o:p /></span>
<br />> <span style="font-size: 10pt;"><o:p>
</o:p></span>
<br />> <span style="font-size: 10pt;">Thanks for the
help.<o:p /></span>
<br />> <span style="font-size: 10pt;"><o:p>
</o:p></span>
<br />> <span style="font-size: 10pt;">-Luis<o:p /></span>
<br /><b>------- End of Original Message
-------</b>
<br />
<br />Hi Luis,
<br />
<br />Sure - it appears you have some largish log files. But the biggest I see are the secure file at 110Meg and the messages file at 62Meg. Everything I see on that list probably won't add up to more than 1Gig. Since most servers have about 4Gig for /var - that's probably not the problem. (Although deleting the older files with "rm -f /var/log/*.gz" would definitely help)
<br />
<br />You might check out the httpd directory under /var/log. That's the Apache webserver logs directory. And I've seen a persistent PHP script error fill that /var partition with errors in the /var/log/httpd/error.log file. If that isn't the problem - here's how you find it.
<br />
<br />Go into the /var partition. After looking at the list of files with "ls -lh" - you may be able to spot the problem. The "h" switch gives you "human" readable size output (kilobytes, megabytes, gigabytes). But if the files eating up the partiation are in a directory instead of /var - use "du -hs *" to look at the sizes of the files AND directories. This output is also in human readable size output.
<br />
<br />With that output, you should be able to spot what directory is using up so much of the space on that partition. When you find the directory - go into it and use the command again. The "du -hs *" command is very helpful in tracking down what's screwing up and eating up drive space.
<br />
<br />Once you find it - delete anything you can. If its older log files in /var/log/httpd, just delete anything named .gz. If its mail spool files stuck unable to send in the /var/spool/mqueue - delete them. (I one time found a server that had been running for a year and a half that had 57,000+ files in that directory!) If its incoming SPAM and other undeliverable e-mail, they may be stuck in the /var/spool/mail, /var/spool/mqueue.in, or /var/spool/MailScanner/quarantine directories. Again - delete anything eating up excessive space in those directories.
<br />
<br />Good luck.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
</font>
</BODY>
</HTML>