Phantom /var full messages

[Jerry McAllister]

> 
> --On Friday, September 10, 2004 11:58:41 AM +0100 shahid at zonewave.net wrote:
> 
> >> I'm running snort 2.1.3 and mysql 3.23.58 on FreeBSD 4.9 RELEASE.  All
> >> applications are built from ports.
> >>
> >> Periodically I get /var full messages and everything comes to a grinding
> >> halt.  The problem is, /var isn't full.
> >>
> >> df -h will show /var at 104%, but du -h /var shows /var at 40% (for
> >> example).  If I shut down snort and mysql, wait for a minute and then
> >> start
> >> them back up, df agrees with du again.
> >
> > The best thing to do is increase some more space in /var (as default it is
> > 256MB?) - you need to mount /var somehow to 400MB. How to do that?
> 
> How in the world would that help?  (BTW, /var is 31GB)  The problem isn't 
> that I'm running out of space.  The problem is that df *thinks* I'm out of 
> space, most likely because of a filehandle problem (but I'll confirm that 
> here once I figure it out.)

No, you are running out of space!   DF has nothing to do with it.

If one of the processes grabs some file space and then unlinks, it
is still holding/using that space and probably needs it, even if 
one method (df) shows it used and another (du) does not.   Don't be 
fooled by the red herring of du and df disagreeing.  Some process is 
trying to use that space and you need more of it.   

If you are doing database stuff, then I can't imagine having a /var
of less than a few GB, unless you move a lot of stuff out of /var and
create links.   See some recent previous posts on the subject.

////jerry

> 
> Paul Schmehl (pauls at utdallas.edu)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> AVIEN Founding Member
> http://www.utdallas.edu