/var getting full

[Ian Lepore]

On Fri, 2012-04-27 at 10:14 -0500, Efraín Déctor wrote:
> Hello. I have a server using FreeBSD 8.2, and recently I’ve noticed that /var is getting full But du hs /var shows me this:
> 
> 14M    /var/
> 
> How Can I know what is using var to free space?
> 
> Thank you.
> 
> OS info:
> FreeBSD edh.edh 8.2-RELEASE-p3 FreeBSD 8.2-RELEASE-p3 #0: Tue Sep 27 18:45:57 UTC 2011     root at amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

I would speculate that some process has unlinked a file but still has it
open so the space is still in use.  Try
 
  procstat -af | grep /var

and look especially for lines that have a huge number in the OFFSET
column (although I'm not sure that's definitive -- the file descriptor
could be positioned at an offset less than the file size).

-- Ian