From owner-freebsd-questions Tue Jun 6 1:30:53 2000 Delivered-To: freebsd-questions@freebsd.org Received: from matrix.42.org (matrix.42.org [194.246.250.200]) by hub.freebsd.org (Postfix) with ESMTP id 934EA37BFA7 for ; Tue, 6 Jun 2000 01:30:49 -0700 (PDT) (envelope-from sec@42.org) Received: (from sec@localhost) by matrix.42.org (8.8.8/8.8.5) id KAA23888 (sender ); Tue, 6 Jun 2000 10:30:43 +0200 (CEST) Date: Tue, 6 Jun 2000 10:30:42 +0200 From: Stefan `Sec` Zehl To: Jeff Gray Cc: freebsd-questions@freebsd.org Subject: Re: How not to reboot, was part of df - du leakage Message-ID: <20000606103042.A23681@matrix.42.org> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: ; from jwg2@adsl-63-201-55-220.dsl.snfc21.pacbell.net on Mon, Jun 05, 2000 at 09:12:51AM -0700 I-love-doing-this: really X-Modeline: vim:set ts=8 sw=4 smarttab tw=72 si noic notitle: Accept-Languages: de, en X-URL: http://sec.42.org/ Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Mon, Jun 05, 2000 at 09:12:51AM -0700, Jeff Gray wrote: > As part of the earlier thread it was suggested that the way to resolve the > problem of a growing /var fs [as shown by df] and a stable /var [as shown > by du] was to reboot into single user mode and run fsck. I never had a problem of this kind. So far it's always been a running process holding a file open. If you already checked the usual suspects (syslog/apache), you can use lsof (port sysutils/lsof) which can list all open files. With a bit of digging you should be able to find the Process. You can then check if that process has a way of closing and reopening the logfiles without terminating the process (usually kill -HUP) > Running 3.3 R > /var is growing at 50K an hour. No log files being rotated, that I am > aware of. Did you add any file to /etc/newsyslog.conf ? CU, Sec -- One of the main causes of the fall of the Roman Empire was that, lacking zero, they had no way to indicate successful termination of their C Programs. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message