/var grows, apache open file, which file?

[Dan Nelson]

In the last episode (Feb 06), Gelsema, P (Patrick) - FreeBSD said:
> I noticed that my var slice is getting eaten by apache. The amount of free
> space is getting less and less per day.  So I started to investigate.
> 
> I did the following;
> 
> # fstat -u www | grep var | more
> www      httpd      97042    9 /var      74653 -rw-------  176907484  w
> www      httpd      97042   12 /var      71575 -rw-------  1345623  w
> www      httpd      97042   13 /var      24693 -rw-r--r--       0  w
> www      httpd      97042   15 /var      70919 -rw-------       0  w
> www      httpd      97042   16 /var      70919 -rw-------       0  w
> www      httpd      26059    9 /var      74653 -rw-------  176907484  w
> www      httpd      26059   12 /var      71575 -rw-------  1345623  w
> 
> So I have an Inumber, lets search for that.
> 
> # find / -inum 74653
> /usr/ports/net/pptpclient/files
> 
> This confuses me! That is on a different slice.

Then that is not the inode you are looking for.  Use "find -x /var ..." to
limit the search to just the /var mountpoint.  Your problem is probably due
to a bad logfile rotator that isn't signalling apache to close&reopen the
logs, so it keeps logging to a file you have deleted.  If you're using
newsyslog, make sure you have listed your apache pidfile on the line
correspoinding to any apache logs so it knows which process to signal.  See
the newsyslog.conf manpage for more details.

-- 
	Dan Nelson
	dnelson at allantgroup.com