NAT and var/log

[James Wyatt]

There are a number of things under /var that can fill it up: /var/log,
/var/mail, /var/run, /var/tmp. Common things that fill up are large user
mailboxes, folks using vi to edit/view a large file, and log files that
are deleted while still open. (Other reasons as well, but these are most.)

Try doing a "du -kv /var/" and seeing if the total matches what shows as
"used" on a "df -k /var/". If there is a large difference, then someone
has likely deleted a file that is still open - usually by syslog. You can
restart syslog "kill -hup `cat /var/run/syslog.pid`" and see if that
helps. If that doesn't work and you can't find who has the file open, you
will likely have to reboot. (And educate an admin or user...)

If there is no large difference between what du tells you is used by files
it can see and df shows the disk has used, then you can look for large
files with something like "find /var/ -type f -size +1000 -print". I would
look in /var/mail/ and /var/log/ first...

If it comes and goes, then it's likely a user that needs to learn "more"
and that vi (some versions) keep temp files unless they use read-only mode
like "vi -r <file>". No doubt others can offer even better advice - this
is a great list in terms of real experience... (^_^)

Hope this helps - Jy@

On Fri, 23 Jan 2004, Lewis Watson wrote:
> Hi there,
> We recently set up a FreeBsd firewall/ router for a client and /var is
> getting pretty full. Is there a table or  log somewhere in /var that is
> filling up? I looked in /var/log and there is nothing here that is out of
> the ordinary. I would appreciate any pointers here.
> Thanks.
> Lewis
>
> _______________________________________________
> freebsd-isp at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-isp
> To unsubscribe, send any mail to "freebsd-isp-unsubscribe at freebsd.org"
>