File system full

[Giorgos Keramidas]

On 2006-10-18 07:13, Paul Murphy <paul.murphy at cogeco.ca> wrote:
>Giorgos Keramidas wrote:
>>On 2006-10-18 07:53, "Office of CEO- rithy4u.NET" <root at rithy4u.net> wrote:
>>> Dear All,
>>> My firewall server was running out of space on / partition I
>>> have try to reboot/fsck and delete all unneccessary files
>>> inside / but I still get 12 MB of free space with total 495 MB
>>> worth of that partition. Any ideas?
>>
>> First of all, try to track down where all the space has gone, by
>> using `df' and `du' with the -x option.  For example, you can get
>> a good idea of which places in your root filesystem are the top-10
>> users of space with:
>>
>>     # cd /
>>     # du -xm . | sort -nr | head -10
>>
>> If this doesn't show up a lot of stuff, then there's probably a
>> rogue process which has opened a file and then removed it, so
>> it's not directly visible by traversing the tree with `du', but
>> you can still look for it with:
>>
>>     # fstat -f / | sort -k +8
>>
>> After you get this sort of information, we can make more informed
>> suggestions about the best way to move forward :)
>
> I have been trying to track down a similar problem! Using the above
> method I think I have found 'natd' to be the culprit. Should 'natd'
> receive a signal when 'alias.log' rolls over? Restarting 'natd' seems
> to have releases some megabytes.

Nice catch, Paul!

The `alias.log' file is supposed to be in `/var/log', but I guess if you
use a single root filesystem for everything, this can end up filling the
root filesystem.

The file `alias.log' is not rotated by `newsyslog.conf', so maybe we
should add it there?  Then we can let `newsyslog' signal `natd' by:

%%%
diff -r 4474abb9619a etc/newsyslog.conf
--- a/etc/newsyslog.conf	Fri Oct 13 17:34:54 2006 +0300
+++ b/etc/newsyslog.conf	Wed Oct 18 15:54:52 2006 +0300
@@ -18,6 +18,7 @@
 #
 # logfilename          [owner:group]    mode count size when  flags [/pid_file] [sig_num]
 /var/log/all.log			600  7	   *	@T00  J
+/var/log/alias.log			600  7     100  *     JC    /var/run/natd.pid
 /var/log/amd.log			644  7	   100	*     J
 /var/log/auth.log			600  7     100  *     JC
 /var/log/console.log			600  5	   100	*     J
%%%

Can you please add this line to your newsyslog.conf file and let it run
for a while to see if it prevents the `alias.log' file of `natd' to fill
your /var/log filesystem?

I don't use `natd', so I can't test this myself for a long enough
period.

Regards,
Giorgos