Date: Wed, 18 Oct 2006 15:57:55 +0300 From: Giorgos Keramidas <keramida@ceid.upatras.gr> To: Paul Murphy <paul.murphy@cogeco.ca> Cc: freebsd-questions@freebsd.org, root@rithy4u.net Subject: Re: File system full Message-ID: <20061018125755.GB15285@gothmog.pc> In-Reply-To: <45360C5F.4090400@cogeco.ca> References: <45357AF8.1020101@rithy4u.net> <20061018014819.GA72686@gothmog.pc> <45360C5F.4090400@cogeco.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2006-10-18 07:13, Paul Murphy <paul.murphy@cogeco.ca> wrote: >Giorgos Keramidas wrote: >>On 2006-10-18 07:53, "Office of CEO- rithy4u.NET" <root@rithy4u.net> wrote: >>> Dear All, >>> My firewall server was running out of space on / partition I >>> have try to reboot/fsck and delete all unneccessary files >>> inside / but I still get 12 MB of free space with total 495 MB >>> worth of that partition. Any ideas? >> >> First of all, try to track down where all the space has gone, by >> using `df' and `du' with the -x option. For example, you can get >> a good idea of which places in your root filesystem are the top-10 >> users of space with: >> >> # cd / >> # du -xm . | sort -nr | head -10 >> >> If this doesn't show up a lot of stuff, then there's probably a >> rogue process which has opened a file and then removed it, so >> it's not directly visible by traversing the tree with `du', but >> you can still look for it with: >> >> # fstat -f / | sort -k +8 >> >> After you get this sort of information, we can make more informed >> suggestions about the best way to move forward :) > > I have been trying to track down a similar problem! Using the above > method I think I have found 'natd' to be the culprit. Should 'natd' > receive a signal when 'alias.log' rolls over? Restarting 'natd' seems > to have releases some megabytes. Nice catch, Paul! The `alias.log' file is supposed to be in `/var/log', but I guess if you use a single root filesystem for everything, this can end up filling the root filesystem. The file `alias.log' is not rotated by `newsyslog.conf', so maybe we should add it there? Then we can let `newsyslog' signal `natd' by: %%% diff -r 4474abb9619a etc/newsyslog.conf --- a/etc/newsyslog.conf Fri Oct 13 17:34:54 2006 +0300 +++ b/etc/newsyslog.conf Wed Oct 18 15:54:52 2006 +0300 @@ -18,6 +18,7 @@ # # logfilename [owner:group] mode count size when flags [/pid_file] [sig_num] /var/log/all.log 600 7 * @T00 J +/var/log/alias.log 600 7 100 * JC /var/run/natd.pid /var/log/amd.log 644 7 100 * J /var/log/auth.log 600 7 100 * JC /var/log/console.log 600 5 100 * J %%% Can you please add this line to your newsyslog.conf file and let it run for a while to see if it prevents the `alias.log' file of `natd' to fill your /var/log filesystem? I don't use `natd', so I can't test this myself for a long enough period. Regards, Giorgos
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061018125755.GB15285>