Welcome to the Linux Foundation Forum!

Unsure of why my var directory is so large

Hi,

When I run df -h it gives me this

Filesystem Size Used Avail Use% Mounted on

/dev/sda1 950M 336M 566M 38% /

varrun 3.9G 64K 3.9G 1% /var/run

varlock 3.9G 0 3.9G 0% /var/lock

udev 3.9G 32K 3.9G 1% /dev

devshm 3.9G 0 3.9G 0% /dev/shm

/dev/sda5 4.7G 382M 4.3G 9% /usr

/dev/sda6 4.7G 4.1G 655M 87% /var

/dev/sda7 920G 16G 904G 2% /home

none 3.9G 1.1G 2.9G 28% /tmp

As you can see the /var usage is 87%. So I wanted to see why.

I then tried to look in /var like so

/var# du -hx --max-depth=1

2.7M ./backups

105M ./cache

63M ./lib

0 ./local

0 ./lock

0 ./mail

0 ./opt

0 ./run

8.0K ./spool

3.4M ./log

0 ./tmp

1.4G ./www

1.6G .

I'm not sure how in the du -hx --max-depth=1 version above it gives a file size of 1.6g but in the first command (df -h) it says the var directory has a file size of 4.1g.

Help would be much appreciated...

Here's some more background

A few days ago I had a high Usage for the /Var just like above. So I tried to remove the .gz files under the apache2 directory.

Somehow instead I managed to remove all of the files in the apache2 directory. BUT the usage size for /var still did not go down.

I have since reinstated the apache2 log files and they are not populating.

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Comments

  • Posts: 1,114
    Sometimes /var/log/ gets filled up when a process goes haywire and one of the log files doesn't get turned over because it's growing to fast. Check all your files in /var/log/ and see if one of them is larger than it's suppose to be.
  • Posts: 3
    Thanks GoinEasy9

    The only one I could see that was very large was the auth.log.0 file.

    I cleared it's contents with > /var/log/auth.log.0 but this did not change the usage file size of /var

    The /var directory has now grown to over 90% usage.

    When I tried to have a look at the last files that have been updated using find /var -type f -mmin -90 these came up

    /var/run/utmp
    /var/log/lastlog
    /var/log/auth.log
    /var/log/messages
    /var/log/wtmp
    /var/log/syslog

    I've tried clearing the contents of all of these - except the top one - but nothing has changed. Starting to panic
  • Posts: 1,114
    The offending file when I had my problem was /var/log/meassages. It seems that either a bad cups update or a bad HP printer driver was sending a continuous stream of errors to that file, which made it grow to over 2 GB's. That would have been the first place I would have looked.
    I'm hoping someone with more experience will come along who may have run into this problem and can give you some more ideas. I don't usually separate my /var, I leave it in /root. I'm just out of ideas at the moment, unless it's something simple that hasn't occurred to me yet.
    I'll post again if I think of something, maybe wake up the other mods and see if they have an answer. Be patient, answers usually get here, even if it takes a while.
  • Posts: 3
    I think it has more to do with the error logs I removed. After some research I found that some of those files are still open.

    I typed

    lsof | grep deleted

    and it returned all of the files I had deleted.

    I have tried to restart apache2...

    /etc/init.d/apache2 restart
    * Restarting web server apache2 [ OK ]

    and now the new log files are recording things but when I do another

    lsof | grep deleted

    and the same files that I deleted show up as open still. Is there a way I can somehow get rid of them?

    Also is there a way I can check the restart worked?

    Many thanks

  • Posts: 647
    edited November 2011
    I suspect you messed something up when you deleted files that were in use by some process (apache).

    I do not know how the "restart" option is implemented in the init.d script, it might be calling the "graceful" option to apache. Could you try *stop*? Check if the files are still open afterwards.

    EDIT:spelling

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Categories

Upcoming Training