ppp filling /var

[James]

On Thursday 02 June 2005 04:52 am, Vizion wrote:
> On Thursday 02 June 2005 04:47,  the author James contributed to the
> dialogue on-
>
>  ppp filling /var:
> >After ppp runs for a few days:
> >
> ># df
> >Filesystem    Size   Used  Avail Capacity  Mounted on
> >/dev/ad0s1a   126M    49M    67M    42%    /
> >/dev/ad0s1f   252M    18K   232M     0%    /tmp
> >/dev/ad0s1g   8.1G   1.1G   6.4G    15%    /usr
> >/dev/ad0s1e   252M   252M -20.0M   109%    /var <----!!!
> >procfs        4.0K   4.0K     0B   100%    /proc
> >
> ># du -h /var
> >... snip ...
> >12M    /var
> >
> >After killing ppp:
> >
> ># df
> >Filesystem    Size   Used  Avail Capacity  Mounted on
> >/dev/ad0s1a   126M    49M    67M    42%    /
> >/dev/ad0s1f   252M    18K   232M     0%    /tmp
> >/dev/ad0s1g   8.1G   1.1G   6.4G    15%    /usr
> >/dev/ad0s1e   252M    12M   219M     6%    /var <----
> >procfs        4.0K   4.0K     0B   100%    /proc
> >
> ># du -h /var
> >... snip ...
> >12M    /var
> >
> >Anyone know how to fix this? Google was no help.
> >
> >note: this is not a problem with /var/log/* filling up, as du will show,
> > or any file written to disk... its *something* else
> >
> >Full output of du -h
> ># du -h /var
> >2.0K    /var/account
> >2.0K    /var/at/jobs
> >2.0K    /var/at/spool
> >6.0K    /var/at
> >10.0K   /var/backups
> >4.0K    /var/crash
> >2.0K    /var/cron/tabs
> >4.0K    /var/cron
> >2.0K    /var/db/ipf
> > ... snip ...  (/var/db/pkg/*)
> >2.2M    /var/db/pkg
> >4.0K    /var/db/ports/gettext
> >6.0K    /var/db/ports
> > 28K    /var/db/portaudit
> >474K    /var/db/tripwire/report
> >6.5M    /var/db/tripwire
> >9.8M    /var/db
> >2.0K    /var/empty
> >2.0K    /var/heimdal
> >1.7M    /var/log
> >8.0K    /var/mail
> >4.0K    /var/msgs
> >2.0K    /var/preserve
> >2.0K    /var/run/ppp
> > 94K    /var/run
> >2.0K    /var/rwho
> >2.0K    /var/spool/lock
> >2.0K    /var/spool/lpd
> >2.0K    /var/spool/mqueue
> >2.0K    /var/spool/opielocks
> >2.0K    /var/spool/output/lpd
> >4.0K    /var/spool/output
> >2.0K    /var/spool/uucp/.Preserve
> >2.0K    /var/spool/uucp/.Sequence
> >2.0K    /var/spool/uucp/.Status
> >2.0K    /var/spool/uucp/.Temp
> >2.0K    /var/spool/uucp/.Xqtdir
> > 12K    /var/spool/uucp
> >2.0K    /var/spool/uucppublic
> >4.0K    /var/spool/clientmqueue
> > 32K    /var/spool
> >2.0K    /var/tmp/vi.recover
> >112K    /var/tmp/etc/defaults
> >2.0K    /var/tmp/etc/X11
> >4.0K    /var/tmp/etc/gnats
> > 52K    /var/tmp/etc/isdn
> >2.0K    /var/tmp/etc/kerberosIV
> >294K    /var/tmp/etc/mail
> > 56K    /var/tmp/etc/mtree
> > 16K    /var/tmp/etc/namedb
> > 50K    /var/tmp/etc/periodic/daily
> >6.0K    /var/tmp/etc/periodic/monthly
> > 42K    /var/tmp/etc/periodic/security
> > 18K    /var/tmp/etc/periodic/weekly
> >118K    /var/tmp/etc/periodic
> >4.0K    /var/tmp/etc/ppp
> >2.0K    /var/tmp/etc/skel
> >108K    /var/tmp/etc/ssh
> >10.0K   /var/tmp/etc/ssl
> > 22K    /var/tmp/etc/uucp
> >1.3M    /var/tmp/etc
> >1.3M    /var/tmp
> > 22K    /var/yp
> >2.0K    /var/games/hackdir/save
> >4.0K    /var/games/hackdir
> >2.0K    /var/games/larn
> >2.0K    /var/games/phantasia
> >10.0K   /var/games
> > 13M    /var
>
> I presume you are running ppp as a masquerading engine on an internal lan.
>
> Is this a new phenomenon or has it been with you ever since you started
> ppp? The fact that you have such a comparatively large /var suggests that
> the machine may have been set up with this purpose in mind and that you
> simply need a larger /var. If the problem is new/intermittent then you
> might want to monitor look your network traffic carefully to identify the
> source.
>
> David

I am running ppp to establish the dsl link so the firewall box gets assigned 
the static ip and not the qwest gateway/modem and natd handles the nat.

This has been happening since I setup ppp

The size is the sysconfig default size for /var if auto is selected for the 
partition creation.

>If the problem is new/intermittent then you
> might want to monitor look your network traffic carefully to identify the 
>source.

not sure what you are suggesting, its not logs filling /var.