ppp filling /var

[James]

On Thursday 02 June 2005 07:21 am, Alex Zbyslaw wrote:
> James wrote:
> >After ppp runs for a few days:
> >
> ># df
> >Filesystem    Size   Used  Avail Capacity  Mounted on
> >/dev/ad0s1a   126M    49M    67M    42%    /
> >/dev/ad0s1f   252M    18K   232M     0%    /tmp
> >/dev/ad0s1g   8.1G   1.1G   6.4G    15%    /usr
> >/dev/ad0s1e   252M   252M -20.0M   109%    /var <----!!!
> >procfs        4.0K   4.0K     0B   100%    /proc
> >
> ># du -h /var
> >... snip ...
> >12M    /var
>
> If a file is opened, deleted and then written to, it will keep taking space
> without showing up under du.  Does fstat show anything useful when ppp is
> running?
>
> Could you use pppd instead?

# fstat -f /var
USER     CMD          PID   FD MOUNT      INUM MODE         SZ|DV R/W
aksis    fstat      72843   wd /var      16259 drwxr-xr-x    1536  r
root     natd       72299    4 /var      16266 -rw-------  31316863  w
aksis    bash       68199   wd /var      16259 drwxr-xr-x    1536  r
smmsp    sendmail     318   wd /var         34 drwxrwx---     512  r
smmsp    sendmail     318    4 /var        244 -rw-------      49  w
root     sendmail     315   wd /var         23 drwxr-xr-x     512  r
root     sendmail     315    7 /var         96 -rw-------      43  w
root     cron         217   wd /var          9 drwxr-x---     512  r
root     cron         217    3 /var        304 -rw-r--r--       4 rw
root     syslogd      209    7 /var      16290 -rw-------  100708  w
root     syslogd      209    8 /var      16285 -rw-------   86683  w
root     syslogd      209    9 /var      16279 -rw-------   12534  w
root     syslogd      209   10 /var      16325 -rw-------    1892  w
root     syslogd      209   11 /var      16281 -rw-r--r--       0  w
root     syslogd      209   12 /var      16301 -rw-------   11407  w
root     syslogd      209   13 /var      16317 -rw-------   83869  w
root     syslogd      209   15 /var      16286 -rw-r-----       0  w
root     syslogd      209   16 /var      16263 -rw-------   26137  w

So it looks like it is natd and not ppp. 
lsof isn't showing what file natd has open and is writing to.

At this time, I don't know how to configure pppd, so I can't use it yet. :-(

What does natd do that !!! :-\ is that a bug?