Results 1 to 6 of 6

Thread: var logs filling up disk space

  1. #1
    Junior Member
    Join Date
    Aug 2012
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Default var logs filling up disk space

    i am running rhel 5 server...i have some issues

    1. will the server hang if the free space in /var is say about 30%

    2. the other thing is i am seeing a log file named audit and sa taking up the space

    [root@PDB log]# du -sh
    31M .
    [root@PDB log]# du -sh *
    9.0K acpid
    758K anaconda.log
    41K anaconda.syslog
    70K anaconda.xlog
    20M audit
    0 boot.log
    0 boot.log.1
    0 boot.log.2
    0 boot.log.3
    0 boot.log.4
    27K btmp
    2.0K conman
    2.0K conman.old
    115K cron
    130K cron.1
    130K cron.2
    130K cron.3
    130K cron.4
    15K cups
    34K dmesg
    7.0K faillog
    26K gdm
    2.0K httpd
    22K lastlog
    5.0K mail
    6.0K maillog
    7.0K maillog.1
    7.0K maillog.2
    7.0K maillog.3
    7.0K maillog.4
    1.0K mcelog
    132K messages
    147K messages.1
    147K messages.2
    147K messages.3
    147K messages.4
    3.0K pm
    2.0K ppp
    40K prelink
    45K rpmpkgs
    45K rpmpkgs.1
    45K rpmpkgs.2
    45K rpmpkgs.3
    45K rpmpkgs.4
    0 rpmpkgs.aiIzl3667
    0 rpmpkgs.AUECc6967
    0 rpmpkgs.BbDlW8720
    0 rpmpkgs.dCyi20366
    (output ommited here)
    0 rpmpkgs.zfLd24202
    0 rpmpkgs.zIuU11614
    7.1M sa
    2.0K samba
    73K scrollkeeper.log
    5.0K secure
    4.0K secure.1
    4.0K secure.2
    0 secure.3
    3.0K secure.4
    2.0K setroubleshoot
    0 spooler
    0 spooler.1
    0 spooler.2
    0 spooler.3
    0 spooler.4
    2.0K squid
    1.0K tallylog
    68K up2date
    74K up2date.1
    75K up2date.2
    74K up2date.3
    74K up2date.4
    490K wtmp
    71K Xorg.0.log
    71K Xorg.0.log.old
    0 yum.log
    2.0K yum.log.1

    [root@PDB log]# cd audit
    [root@PDB audit]# ls
    audit.log audit.log.1 audit.log.2 audit.log.3
    [root@PDB audit]# ls -lh
    total 20M
    -rw------- 1 root root 4.3M Sep 15 10:30 audit.log
    -r-------- 1 root root 5.1M Aug 28 02:00 audit.log.1
    -r-------- 1 root root 5.1M Aug 6 20:40 audit.log.2
    -r-------- 1 root root 5.1M Jul 16 10:20 audit.log.3

    is it ok to truncate the audit.log.3, audit.log.2 ... to free some space

    3. what is actually the sa folder

    thank you

  2. #2
    Senior Member Rahul.Patil's Avatar
    Join Date
    Feb 2012
    Location
    Mumbai india
    Posts
    486
    Thanks
    10
    Thanked 50 Times in 47 Posts
    Rep Power
    8

    Default

    [QUOTE]1. will the server hang if the free space in /var is say about 30%

    Post output of below commands
    Code:
    df -kh
    Code:
    df -i
    2. the other thing is i am seeing a log file named audit and sa taking up the space
    7MB & 20MB not a not a big files , there may be other big files in your /var , that you can check using :
    Code:
    du -sh /var/*/
    below command show you files which above 100M
    Code:
    find /var/ -size +100M
    3. what is actually the sa folder
    sa is from sysstat tool which is use for system performance monitoring
    you can find any file from which package and what is use from below command
    Code:
    rpm -qf /path/of/file
    Note: rpm -qf will work if those file installed using rpm or yum
    Rahul Patil <http://www.linuxian.com>

  3. #3
    Junior Member
    Join Date
    Aug 2012
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Default info requested

    hi

    here are the info requested

    [root@PDB ~]# df -kh
    Filesystem Size Used Avail Use% Mounted on
    /dev/cciss/c0d1p1 9.7G 2.5G 6.8G 27% /
    /dev/cciss/c0d0p7 494M 226M 243M 49% /var
    /dev/cciss/c0d1p11 3.9G 144M 3.6G 4% /home
    /dev/cciss/c0d0p6 4.9G 211M 4.4G 5% /tmp
    /dev/cciss/c0d1p10 4.9G 2.6G 2.1G 57% /usr
    /dev/cciss/c0d1p9 9.7G 151M 9.1G 2% /oratemp01
    /dev/cciss/c0d0p3 18G 424M 17G 3% /app
    /dev/cciss/c0d1p8 18G 9.7G 7.0G 59% /oracle
    /dev/cciss/c0d0p2 41G 37G 2.6G 94% /oralogs01
    /dev/cciss/c0d1p7 41G 177M 39G 1% /oralogs02
    /dev/cciss/c0d1p6 59G 181M 55G 1% /oraindex02
    /dev/cciss/c0d1p5 59G 181M 55G 1% /oraindex01
    /dev/cciss/c0d1p3 126G 21G 100G 17% /oradata02
    /dev/cciss/c0d1p2 126G 36G 84G 31% /oradata01
    /dev/cciss/c0d0p1 190M 14M 167M 8% /boot
    tmpfs 1.9G 1007M 905M 53% /dev/shm


    [root@PDB ~]# df -i
    Filesystem Inodes IUsed IFree IUse% Mounted on
    /dev/cciss/c0d1p1 2621440 16127 2605313 1% /
    /dev/cciss/c0d0p7 130560 1410 129150 2% /var
    /dev/cciss/c0d1p11 1048576 221 1048355 1% /home
    /dev/cciss/c0d0p6 1312000 25 1311975 1% /tmp
    /dev/cciss/c0d1p10 1312000 124263 1187737 10% /usr
    /dev/cciss/c0d1p9 2621440 11 2621429 1% /oratemp01
    /dev/cciss/c0d0p3 4723520 69 4723451 1% /app
    /dev/cciss/c0d1p8 4723520 46582 4676938 1% /oracle
    /dev/cciss/c0d0p2 11021248 937 11020311 1% /oralogs01
    /dev/cciss/c0d1p7 11021248 11 11021237 1% /oralogs02
    /dev/cciss/c0d1p6 15730624 11 15730613 1% /oraindex02
    /dev/cciss/c0d1p5 15730624 11 15730613 1% /oraindex01
    /dev/cciss/c0d1p3 34078720 81 34078639 1% /oradata02
    /dev/cciss/c0d1p2 34078720 28 34078692 1% /oradata01
    /dev/cciss/c0d0p1 50200 35 50165 1% /boot
    tmpfs 489168 98 489070 1% /dev/shm


    [root@PDB ~]# du -sh /var/*/
    3.0K /var/account/
    1.3M /var/cache/
    2.0K /var/crash/
    2.0K /var/cvs/
    10K /var/db/
    8.0K /var/empty/
    2.0K /var/games/
    4.0K /var/gdm/
    58M /var/lib/
    2.0K /var/local/
    8.0K /var/lock/
    31M /var/log/
    12K /var/lost+found/
    1.6M /var/mail/
    4.0K /var/net-snmp/
    2.0K /var/nis/
    252M /var/opt/
    121M /var/opt_bac/
    2.0K /var/preserve/
    2.0K /var/racoon/
    153K /var/run/
    1.7M /var/spool/
    3.0K /var/tmp/
    2.0K /var/tux/
    6.0K /var/VRTSralus/
    5.4M /var/www/
    6.0K /var/yp/

    [root@PDB ~]# find /var/ -size +100M
    /var/opt_bac/NAI/LinuxShield/run/TestEngDat32/avvscan.dat

    hope this will help you to answer my questions

    thanks alot

  4. #4
    Senior Member Rahul.Patil's Avatar
    Join Date
    Feb 2012
    Location
    Mumbai india
    Posts
    486
    Thanks
    10
    Thanked 50 Times in 47 Posts
    Rep Power
    8

    Default

    Hi,

    /var only around 500MB ??, it's very bad.

    you allocated too space to / instead of /var

    it should be big and setup in lvm

    only two directories taking too much space
    252M /var/opt/
    121M /var/opt_bac

    You can move "/var/opt_bac/NAI/LinuxShield/run/TestEngDat32/avvscan.dat" to other location if possible
    Rahul Patil <http://www.linuxian.com>

  5. #5
    Junior Member
    Join Date
    Aug 2012
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Default

    Quote Originally Posted by Rahul.Patil View Post
    Hi,

    /var only around 500MB ??, it's very bad.

    you allocated too space to / instead of /var

    it should be big and setup in lvm

    only two directories taking too much space
    252M /var/opt/
    121M /var/opt_bac

    You can move "/var/opt_bac/NAI/LinuxShield/run/TestEngDat32/avvscan.dat" to other location if possible
    Actually the systems were setup by some consultants according to their specifications. so i cant move the files.

    wat will happen if i truncate the audit files? will there be any problem?

    thanks

  6. #6
    Senior Member Rahul.Patil's Avatar
    Join Date
    Feb 2012
    Location
    Mumbai india
    Posts
    486
    Thanks
    10
    Thanked 50 Times in 47 Posts
    Rep Power
    8

    Default

    Quote Originally Posted by esco View Post
    Actually the systems were setup by some consultants according to their specifications. so i cant move the files.

    wat will happen if i truncate the audit files? will there be any problem?

    thanks
    You can stop auditd service and compress/move/delete that log files
    Rahul Patil <http://www.linuxian.com>

  7. The Following User Says Thank You to Rahul.Patil For This Useful Post:

    ranjitcrajput@gmail.com (22nd September 2012)

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. GDM could not write to your authorisation file - out of disk space
    By chandrasekhar439 in forum CentOS / RHEL / Fedora
    Replies: 6
    Last Post: 9th May 2012, 04:01 PM
  2. How to calculate available disk space on a RAID 5
    By oracle in forum CentOS / RHEL / Fedora
    Replies: 2
    Last Post: 24th July 2011, 02:31 PM
  3. df command: doesnt update the actual disk space available
    By duster in forum CentOS / RHEL / Fedora
    Replies: 1
    Last Post: 16th June 2011, 11:19 PM
  4. Aggregation of Hard disk space of different PCs
    By sanjit_sahu in forum Linux software
    Replies: 1
    Last Post: 22nd April 2009, 01:41 PM
  5. Disk space alert via email
    By aasif.shaikh in forum Shell scripting
    Replies: 1
    Last Post: 10th June 2008, 03:58 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •