[Novalug] another more or less trivial question for a tech session.

[Jeff Stoner]

On Thu, 3 Jan 2008, greg pryzby wrote:

> You need to make sure there is a program cleaning up the var logs. be it
> gzip or removing...
>
> rm /var/log/*[2-9].gz as I don't really care about my older logs (flame
> suit is on so I don't want to hear it!)
>
> you can setup a script to watch file systems and mail u when it reaches
> a threshold also

If you don't have it installed, install logrotate and it can help manage 
the log files on your system.

>> Filesystem           1K-blocks      Used Available Use% Mounted on
>> /dev/hda1              5044156    218240   4569684   5% /
>> tmpfs                   518356         0    518356   0% /lib/init/rw
>> udev                     10240      1532      8708  15% /dev
>> tmpfs                   518356         4    518352   1% /dev/shm
>> /dev/hda6              1011928   1007600         0 100% /var
>> /dev/hda5              1011928     26356    934168   3% /tmp

>> But, /opt is almost empty. The two questions that come up are:
>> 1: where did all the space go? and how do you find this out; and

The /var file system is used to hold variable data (logs, caches, queues, 
etc.). It is used by a great many subsystems of your machine: syslog, 
sendmail/postfix/qmail, auditd, crond, atd, cupsd, httpd, ntpd, 
yum/up2date/apt, squid, and so on and so forth.

Start in /var and do "du -sh *" to see what directories are eating your 
space. "cd" in the biggest space eater and do another "du -sh *" - 
drill-down to see what is where. You'll get into a directory that is a 
subsystem of your machine.

/var/spool/mail is where your mail spools are. Check to see if a 
particular user has a large mail file (root may get a lot of mail.)

/var/spool/clientmqueue and /var/spool/mqueue is where sendmail keeps its 
mail queues. If you use another MTA like Postfix or qmail, then this may 
be a red herring.

/var/log/audit.d holds audit data, which if not configured properly, can 
eat up disk space.

If you use MySQL then chances are it's keeping the data/index files in 
/var/lib/mysql. Same for PostgreSQL.

>> 2: how do you give /var more space?

If you're not using LVM, then you have two options:
- relocate the file system (or a portion of it) to a larger partition
- move subdirectories to another file system and put a symlink in place to 
it (easy but not a great solution)


--Jeff

"I am not available for comment"