Unsure of why my var directory is so large

WAG

Hi,

When I run df -h it gives me this

Filesystem Size Used Avail Use% Mounted on

/dev/sda1 950M 336M 566M 38% /

varrun 3.9G 64K 3.9G 1% /var/run

varlock 3.9G 0 3.9G 0% /var/lock

udev 3.9G 32K 3.9G 1% /dev

devshm 3.9G 0 3.9G 0% /dev/shm

/dev/sda5 4.7G 382M 4.3G 9% /usr

/dev/sda6 4.7G 4.1G 655M 87% /var

/dev/sda7 920G 16G 904G 2% /home

none 3.9G 1.1G 2.9G 28% /tmp

As you can see the /var usage is 87%. So I wanted to see why.

I then tried to look in /var like so

/var# du -hx --max-depth=1

2.7M ./backups

105M ./cache

63M ./lib

0 ./local

0 ./lock

0 ./mail

0 ./opt

0 ./run

8.0K ./spool

3.4M ./log

0 ./tmp

1.4G ./www

1.6G .

I'm not sure how in the du -hx --max-depth=1 version above it gives a file size of 1.6g but in the first command (df -h) it says the var directory has a file size of 4.1g.

Help would be much appreciated...

Here's some more background

A few days ago I had a high Usage for the /Var just like above. So I tried to remove the .gz files under the apache2 directory.

Somehow instead I managed to remove all of the files in the apache2 directory. BUT the usage size for /var still did not go down.

I have since reinstated the apache2 log files and they are not populating.

Goineasy9

Sometimes /var/log/ gets filled up when a process goes haywire and one of the log files doesn't get turned over because it's growing to fast. Check all your files in /var/log/ and see if one of them is larger than it's suppose to be.

WAG

Thanks GoinEasy9

The only one I could see that was very large was the auth.log.0 file.

I cleared it's contents with > /var/log/auth.log.0 but this did not change the usage file size of /var

The /var directory has now grown to over 90% usage.

When I tried to have a look at the last files that have been updated using find /var -type f -mmin -90 these came up

/var/run/utmp
/var/log/lastlog
/var/log/auth.log
/var/log/messages
/var/log/wtmp
/var/log/syslog

I've tried clearing the contents of all of these - except the top one - but nothing has changed. Starting to panic

Goineasy9

The offending file when I had my problem was /var/log/meassages. It seems that either a bad cups update or a bad HP printer driver was sending a continuous stream of errors to that file, which made it grow to over 2 GB's. That would have been the first place I would have looked.
I'm hoping someone with more experience will come along who may have run into this problem and can give you some more ideas. I don't usually separate my /var, I leave it in /root. I'm just out of ideas at the moment, unless it's something simple that hasn't occurred to me yet.
I'll post again if I think of something, maybe wake up the other mods and see if they have an answer. Be patient, answers usually get here, even if it takes a while.

WAG

I think it has more to do with the error logs I removed. After some research I found that some of those files are still open.

I typed

lsof | grep deleted

and it returned all of the files I had deleted.

I have tried to restart apache2...

/etc/init.d/apache2 restart
* Restarting web server apache2 [ OK ]

and now the new log files are recording things but when I do another

lsof | grep deleted

and the same files that I deleted show up as open still. Is there a way I can somehow get rid of them?

Also is there a way I can check the restart worked?

Many thanks

marc

I suspect you messed something up when you deleted files that were in use by some process (apache).

I do not know how the "restart" option is implemented in the init.d script, it might be calling the "graceful" option to apache. Could you try *stop*? Check if the files are still open afterwards.

EDIT:spelling