Thread: var logs filling up disk space

i am running rhel 5 server...i have some issues

1. will the server hang if the free space in /var is say about 30%

2. the other thing is i am seeing a log file named audit and sa taking up the space

[root@PDB log]# du -sh
31M .
[root@PDB log]# du -sh *
9.0K acpid
758K anaconda.log
41K anaconda.syslog
70K anaconda.xlog
20M audit
0 boot.log
0 boot.log.1
0 boot.log.2
0 boot.log.3
0 boot.log.4
27K btmp
2.0K conman
2.0K conman.old
115K cron
130K cron.1
130K cron.2
130K cron.3
130K cron.4
15K cups
34K dmesg
7.0K faillog
26K gdm
2.0K httpd
22K lastlog
5.0K mail
6.0K maillog
7.0K maillog.1
7.0K maillog.2
7.0K maillog.3
7.0K maillog.4
1.0K mcelog
132K messages
147K messages.1
147K messages.2
147K messages.3
147K messages.4
3.0K pm
2.0K ppp
40K prelink
45K rpmpkgs
45K rpmpkgs.1
45K rpmpkgs.2
45K rpmpkgs.3
45K rpmpkgs.4
0 rpmpkgs.aiIzl3667
0 rpmpkgs.AUECc6967
0 rpmpkgs.BbDlW8720
0 rpmpkgs.dCyi20366
(output ommited here)
0 rpmpkgs.zfLd24202
0 rpmpkgs.zIuU11614
7.1M sa
2.0K samba
73K scrollkeeper.log
5.0K secure
4.0K secure.1
4.0K secure.2
0 secure.3
3.0K secure.4
2.0K setroubleshoot
0 spooler
0 spooler.1
0 spooler.2
0 spooler.3
0 spooler.4
2.0K squid
1.0K tallylog
68K up2date
74K up2date.1
75K up2date.2
74K up2date.3
74K up2date.4
490K wtmp
71K Xorg.0.log
71K Xorg.0.log.old
0 yum.log
2.0K yum.log.1

[root@PDB log]# cd audit
[root@PDB audit]# ls
audit.log audit.log.1 audit.log.2 audit.log.3
[root@PDB audit]# ls -lh
total 20M
-rw------- 1 root root 4.3M Sep 15 10:30 audit.log
-r-------- 1 root root 5.1M Aug 28 02:00 audit.log.1
-r-------- 1 root root 5.1M Aug 6 20:40 audit.log.2
-r-------- 1 root root 5.1M Jul 16 10:20 audit.log.3

is it ok to truncate the audit.log.3, audit.log.2 ... to free some space

3. what is actually the sa folder

thank you

[QUOTE]1. will the server hang if the free space in /var is say about 30%

Post output of below commands

Code:

df -kh

Code:

df -i

2. the other thing is i am seeing a log file named audit and sa taking up the space

7MB & 20MB not a not a big files , there may be other big files in your /var , that you can check using :

Code:

du -sh /var/*/

below command show you files which above 100M

Code:

find /var/ -size +100M

3. what is actually the sa folder

sa is from sysstat tool which is use for system performance monitoring
you can find any file from which package and what is use from below command

Code:

rpm -qf /path/of/file

Note: rpm -qf will work if those file installed using rpm or yum

hi

here are the info requested

[root@PDB ~]# df -kh
Filesystem Size Used Avail Use% Mounted on
/dev/cciss/c0d1p1 9.7G 2.5G 6.8G 27% /
/dev/cciss/c0d0p7 494M 226M 243M 49% /var
/dev/cciss/c0d1p11 3.9G 144M 3.6G 4% /home
/dev/cciss/c0d0p6 4.9G 211M 4.4G 5% /tmp
/dev/cciss/c0d1p10 4.9G 2.6G 2.1G 57% /usr
/dev/cciss/c0d1p9 9.7G 151M 9.1G 2% /oratemp01
/dev/cciss/c0d0p3 18G 424M 17G 3% /app
/dev/cciss/c0d1p8 18G 9.7G 7.0G 59% /oracle
/dev/cciss/c0d0p2 41G 37G 2.6G 94% /oralogs01
/dev/cciss/c0d1p7 41G 177M 39G 1% /oralogs02
/dev/cciss/c0d1p6 59G 181M 55G 1% /oraindex02
/dev/cciss/c0d1p5 59G 181M 55G 1% /oraindex01
/dev/cciss/c0d1p3 126G 21G 100G 17% /oradata02
/dev/cciss/c0d1p2 126G 36G 84G 31% /oradata01
/dev/cciss/c0d0p1 190M 14M 167M 8% /boot
tmpfs 1.9G 1007M 905M 53% /dev/shm


[root@PDB ~]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/cciss/c0d1p1 2621440 16127 2605313 1% /
/dev/cciss/c0d0p7 130560 1410 129150 2% /var
/dev/cciss/c0d1p11 1048576 221 1048355 1% /home
/dev/cciss/c0d0p6 1312000 25 1311975 1% /tmp
/dev/cciss/c0d1p10 1312000 124263 1187737 10% /usr
/dev/cciss/c0d1p9 2621440 11 2621429 1% /oratemp01
/dev/cciss/c0d0p3 4723520 69 4723451 1% /app
/dev/cciss/c0d1p8 4723520 46582 4676938 1% /oracle
/dev/cciss/c0d0p2 11021248 937 11020311 1% /oralogs01
/dev/cciss/c0d1p7 11021248 11 11021237 1% /oralogs02
/dev/cciss/c0d1p6 15730624 11 15730613 1% /oraindex02
/dev/cciss/c0d1p5 15730624 11 15730613 1% /oraindex01
/dev/cciss/c0d1p3 34078720 81 34078639 1% /oradata02
/dev/cciss/c0d1p2 34078720 28 34078692 1% /oradata01
/dev/cciss/c0d0p1 50200 35 50165 1% /boot
tmpfs 489168 98 489070 1% /dev/shm


[root@PDB ~]# du -sh /var/*/
3.0K /var/account/
1.3M /var/cache/
2.0K /var/crash/
2.0K /var/cvs/
10K /var/db/
8.0K /var/empty/
2.0K /var/games/
4.0K /var/gdm/
58M /var/lib/
2.0K /var/local/
8.0K /var/lock/
31M /var/log/
12K /var/lost+found/
1.6M /var/mail/
4.0K /var/net-snmp/
2.0K /var/nis/
252M /var/opt/
121M /var/opt_bac/
2.0K /var/preserve/
2.0K /var/racoon/
153K /var/run/
1.7M /var/spool/
3.0K /var/tmp/
2.0K /var/tux/
6.0K /var/VRTSralus/
5.4M /var/www/
6.0K /var/yp/

[root@PDB ~]# find /var/ -size +100M
/var/opt_bac/NAI/LinuxShield/run/TestEngDat32/avvscan.dat

hope this will help you to answer my questions

thanks alot

Hi,

/var only around 500MB ??, it's very bad.

you allocated too space to / instead of /var

it should be big and setup in lvm

only two directories taking too much space
252M /var/opt/
121M /var/opt_bac

You can move "/var/opt_bac/NAI/LinuxShield/run/TestEngDat32/avvscan.dat" to other location if possible

Originally Posted by Rahul.Patil

Hi,

/var only around 500MB ??, it's very bad.

you allocated too space to / instead of /var

it should be big and setup in lvm

only two directories taking too much space
252M /var/opt/
121M /var/opt_bac

You can move "/var/opt_bac/NAI/LinuxShield/run/TestEngDat32/avvscan.dat" to other location if possible

Actually the systems were setup by some consultants according to their specifications. so i cant move the files.

wat will happen if i truncate the audit files? will there be any problem?

thanks

Originally Posted by esco

Actually the systems were setup by some consultants according to their specifications. so i cant move the files.

wat will happen if i truncate the audit files? will there be any problem?

thanks

You can stop auditd service and compress/move/delete that log files