NAT and var/log

[James Wyatt]

Sorry to follow-up on my own post, but it's "du -kx", not "-kv". The "x"
prevents du from wandering into subordinate filesystems mounted under
/var/, if you care to know. It can be very handy to mount /var/log/ in
append-only mode so the logfiles can't be edited... Thanks - Jy@

On Fri, 23 Jan 2004, James Wyatt wrote:
> There are a number of things under /var that can fill it up: /var/log,
> /var/mail, /var/run, /var/tmp. Common things that fill up are large user
> mailboxes, folks using vi to edit/view a large file, and log files that
> are deleted while still open. (Other reasons as well, but these are most.)
>
> Try doing a "du -kv /var/" and seeing if the total matches what shows as
> "used" on a "df -k /var/". If there is a large difference, then someone
> has likely deleted a file that is still open - usually by syslog. You can
> restart syslog "kill -hup `cat /var/run/syslog.pid`" and see if that
> helps. If that doesn't work and you can't find who has the file open, you
> will likely have to reboot. (And educate an admin or user...)
>
> If there is no large difference between what du tells you is used by files
> it can see and df shows the disk has used, then you can look for large
> files with something like "find /var/ -type f -size +1000 -print". I would
> look in /var/mail/ and /var/log/ first...
>
> If it comes and goes, then it's likely a user that needs to learn "more"
> and that vi (some versions) keep temp files unless they use read-only mode
> like "vi -r <file>". No doubt others can offer even better advice - this
> is a great list in terms of real experience... (^_^)
>
> Hope this helps - Jy@
>
> On Fri, 23 Jan 2004, Lewis Watson wrote:
> > Hi there,
> > We recently set up a FreeBsd firewall/ router for a client and /var is
> > getting pretty full. Is there a table or  log somewhere in /var that is
> > filling up? I looked in /var/log and there is nothing here that is out of
> > the ordinary. I would appreciate any pointers here.
> > Thanks.
> > Lewis
> >
> > _______________________________________________
> > freebsd-isp at freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-isp
> > To unsubscribe, send any mail to "freebsd-isp-unsubscribe at freebsd.org"