Phantom /var full messages

Paul Schmehl pauls at
Fri Sep 10 07:49:08 PDT 2004

--On Friday, September 10, 2004 11:58:41 AM +0100 shahid at wrote:

>> I'm running snort 2.1.3 and mysql 3.23.58 on FreeBSD 4.9 RELEASE.  All
>> applications are built from ports.
>> Periodically I get /var full messages and everything comes to a grinding
>> halt.  The problem is, /var isn't full.
>> df -h will show /var at 104%, but du -h /var shows /var at 40% (for
>> example).  If I shut down snort and mysql, wait for a minute and then
>> start
>> them back up, df agrees with du again.
> The best thing to do is increase some more space in /var (as default it is
> 256MB?) - you need to mount /var somehow to 400MB. How to do that?

How in the world would that help?  (BTW, /var is 31GB)  The problem isn't 
that I'm running out of space.  The problem is that df *thinks* I'm out of 
space, most likely because of a filehandle problem (but I'll confirm that 
here once I figure it out.)

Paul Schmehl (pauls at
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member

More information about the freebsd-questions mailing list