File system full
m.seaman at infracaninophile.co.uk
Wed Oct 18 13:35:46 UTC 2006
Giorgos Keramidas wrote:
> On 2006-10-18 07:13, Paul Murphy <paul.murphy at cogeco.ca> wrote:
>> Giorgos Keramidas wrote:
>>> On 2006-10-18 07:53, "Office of CEO- rithy4u.NET" <root at rithy4u.net> wrote:
>>>> Dear All,
>>>> My firewall server was running out of space on / partition I
>>>> have try to reboot/fsck and delete all unneccessary files
>>>> inside / but I still get 12 MB of free space with total 495 MB
>>>> worth of that partition. Any ideas?
>>> First of all, try to track down where all the space has gone, by
>>> using `df' and `du' with the -x option. For example, you can get
>>> a good idea of which places in your root filesystem are the top-10
>>> users of space with:
>>> # cd /
>>> # du -xm . | sort -nr | head -10
>>> If this doesn't show up a lot of stuff, then there's probably a
>>> rogue process which has opened a file and then removed it, so
>>> it's not directly visible by traversing the tree with `du', but
>>> you can still look for it with:
>>> # fstat -f / | sort -k +8
>>> After you get this sort of information, we can make more informed
>>> suggestions about the best way to move forward :)
>> I have been trying to track down a similar problem! Using the above
>> method I think I have found 'natd' to be the culprit. Should 'natd'
>> receive a signal when 'alias.log' rolls over? Restarting 'natd' seems
>> to have releases some megabytes.
> Nice catch, Paul!
> The `alias.log' file is supposed to be in `/var/log', but I guess if you
> use a single root filesystem for everything, this can end up filling the
> root filesystem.
> The file `alias.log' is not rotated by `newsyslog.conf', so maybe we
> should add it there? Then we can let `newsyslog' signal `natd' by:
> diff -r 4474abb9619a etc/newsyslog.conf
> --- a/etc/newsyslog.conf Fri Oct 13 17:34:54 2006 +0300
> +++ b/etc/newsyslog.conf Wed Oct 18 15:54:52 2006 +0300
> @@ -18,6 +18,7 @@
> # logfilename [owner:group] mode count size when flags [/pid_file] [sig_num]
> /var/log/all.log 600 7 * @T00 J
> +/var/log/alias.log 600 7 100 * JC /var/run/natd.pid
> /var/log/amd.log 644 7 100 * J
> /var/log/auth.log 600 7 100 * JC
> /var/log/console.log 600 5 100 * J
> Can you please add this line to your newsyslog.conf file and let it run
> for a while to see if it prevents the `alias.log' file of `natd' to fill
> your /var/log filesystem?
> I don't use `natd', so I can't test this myself for a long enough
natd doesn't do the close and re-open all filehandles thing on receipt
of SIGHUP which pretty much makes it unsuitable for use with newsyslog.
(SIGHUP is caught by natd, but the only thing it does is cause natd to
update its idea of what the IP address is on the nat'ed interface.)
There doesn't seem to be any signal that you can send natd with the
usual 'reread all config files and re-open all file descriptors'
effect that most daemons understand.
Dr Matthew J Seaman MA, D.Phil. Flat 3
7 Priory Courtyard
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW, UK
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20061018/933acc1a/signature.pgp
More information about the freebsd-questions