Disk full problem 1

[openeratech]

Hi All,

I have a Solaris 9 installation on SunFire V100 hardware. I have one slice with /VAR filesystem.

Now this filesystem is showing 100% full status (total size for this slice is 4 GB).

I am confused what shall i delete under /VAR to freeup space.

I have emptied whatever was there under /var/tmp folder

The contents on my box for /VAR is shown below:

drwxr-xr-x 25 root sys 512 May 23 11:14 .
drwxr-xr-x 26 root root 1024 May 5 19:32 ..
drwxrwxr-x 7 root sys 512 May 22 03:10 adm
drwxr-xr-x 2 root sys 512 Apr 27 2001 audit
drwxrwxrwx 3 root root 512 Apr 27 2001 crash
drwxr-xr-x 2 root sys 512 Sep 28 2003 cron
drwxrwxr-x 5 root sys 512 Apr 27 2001 dmi
drwxr-xr-x 5 root root 512 May 21 07:58 dt
drwxr-xr-x 2 root sys 512 May 23 11:05 log
drwx------ 2 root root 8192 Apr 27 2001 lost+found
drwxrwxr-x 3 lp lp 512 Apr 27 2001 lp
drwxrwxrwt 3 root mail 512 May 23 04:32 mail
drwxrwxr-x 2 bin bin 512 Apr 27 2001 news
drwxr-xr-x 2 root sys 512 Apr 27 2001 nis
drwxr-xr-x 3 root sys 512 Apr 27 2001 ntp
drwxrwxr-x 3 root sys 512 Mar 5 2003 opt
drwxrwxrwt 2 bin bin 512 Apr 27 2001 preserve
drwxr-xr-x 8 root sys 512 Apr 27 2001 sadm
drwxr-xr-x 3 bin bin 512 Apr 27 2001 saf
drwxrwxr-x 3 root sys 512 May 21 07:58 snmp
drwxr-xr-x 11 root bin 512 Jul 15 2003 spool
drwxr-xr-x 4 daemon daemon 512 Apr 27 2001 statmon
drwxrwxrwt 3 sys sys 512 May 23 12:31 tmp
drwxr-xr-x 7 uucp uucp 512 Apr 27 2001 uucp
drwxr-xr-x 3 bin bin 512 Apr 27 2001 yp

-----------------------------------------

Please guide me in freeing up space.

Regards
Yunus

 

[KenCunningham]

Hi. A good place to start is to zero out /var/adm/wtmpx:

cat /dev/null > /var/adm/wtmpx

will achieve this.

There may also be a core file in /var, try:

find /var -name core

to check. You can delete or move these if they're required for analysis.

Try a:

find /var -size +2000

to see any other large files which could be zeroed using the same method as wtmpx above. It's possible that you have some undo files under /var/sadm, which could be removed if you're happy that the packages/patches to which they 'belong' are behaving themselves. If you're unsure about any files which might be candidates for deletion/zeroing, post back with details. HTH.

 

[daFranze]

Ken gave a lot of good ideas to solve the problem, but there is one thing you should think about: is /var to small for my installation?
I have seen a lot of installations where customers splitted up their disks into many small slices, most of the time some day one slice was to small. I always suggested to use one big slice for Solaris installation (5-10Gig), one slice for swap and another for user data. And if you have additional disks for your applications this would be the best solution. Do not forget to switch on logging in vfstab, since a fsck of a big FS may take some time without logging.

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[openeratech]

hi,
Thanks for the help.

find /var -size +2000 returned some files. These files were the stored in /var/adm. Actually we are running regular backups at night of Clearcase data. So it creates files for each day and store it in one directory. Over a period of time, this size grown up occupying the entire space.

So i deleted files of yesteryears. It has come down to 47% utilization now.

Thanks once again.

Cheers
Yunus

 

[KenCunningham]

Franz is (as usual) quite correct. However, it seems likely in your case that the old data files are clogging up your system. A strategy for minimising the impact of this might be to a) Compress the files once they are written and/or b) clear the appropriate directory of files older than a certain age on a regular basis (ie delete them or archive them to tape if you think you might need them again). If you need help with that, let us know. Thanks for the star!

 

[openeratech]

Hi,

I am no experience in writing scripts. So i would be glad if you can give me a script that would clearoff the files of 6 months or so older.

regards
Yunus

 

[KenCunningham]

Yunos:

If you wish to compress the files on the fly, you can put something like:

compress (or gzip) /path/to/files/*.extension

in cron and run it every day, or whatever period you wish.

To remove files over 6 months old, put the following in cron:

find /path/to/files -name '*.extension' -mtime +182 -exec rm {} \;

Be careful with rm in a find though - it's often best to test what it'll pick up with an ls first. To add to cron:

01 00 1 6,12 * <command above>

which will run the command at one minute past midnight on the 1st of June and the 1st of December each year.

 

[daFranze]

I agree with Ken, in this case it is the large amount of temporary data which fills up the var filesystem...

There are 2 strategies you can run
a) ask the Clearcase/Backup guys to clean up their temporary files, they know what they need in future
b) delete the old files with a cronjob eg
0 0 * * 1 find /var/cc-files -mtime -50 -exec rm {} \;
rin's each moday at 0:00 and deletes all files under /var/cc-files not being modified the last 50 days...

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[daFranze]

sorry forgot to post my posting before lunch break and Ken was faster...

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[KenCunningham]

As someone else says when this happens - at least we agree! Lunchtime -30 minutes here!

 

[daFranze]

mistyped: 0 0 * * 1 find /var/cc-files -mtime +50 -exec rm {} \;

Ken: lunchbreak is "as long as you wish", during 11:00 and 14:00, minimum (by German law) is 35 minutes, if you work mor than 7 hours a day (afaik);
but we have electronic time recording, we clock out when we go to the cantina and clock in when we go back to office... ;-)

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[coffeysm]

You also might want to remember to use the du command. Next time your /var is full do:

cd /var
du -sk *

It will then list how big each directory is