Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 6 Feb 2009 13:36:43 -0600
From:      Neal Hogan <nealhogan@gmail.com>
To:        "Gelsema, P (Patrick) - FreeBSD" <freebsd@superhero.nl>
Cc:        Dan Nelson <dnelson@allantgroup.com>, freebsd-questions@freebsd.org
Subject:   Re: /var grows, apache open file, which file?
Message-ID:  <ab7b49bc0902061136j7644a335ra228915f90e75fe0@mail.gmail.com>
In-Reply-To: <922bbbdc3563fcba8c8ed34d7fa6bf1f.squirrel@webmail.superhero.nl>
References:  <d518000de7090860de1b014db92acde9.squirrel@webmail.superhero.nl> <20090206190553.GB13084@dan.emsphone.com> <922bbbdc3563fcba8c8ed34d7fa6bf1f.squirrel@webmail.superhero.nl>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On Fri, Feb 6, 2009 at 1:27 PM, Gelsema, P (Patrick) - FreeBSD <
freebsd@superhero.nl> wrote:

> On Fri, February 6, 2009 20:05, Dan Nelson wrote:
> > In the last episode (Feb 06), Gelsema, P (Patrick) - FreeBSD said:
> >> I noticed that my var slice is getting eaten by apache. The amount of
> >> free
> >> space is getting less and less per day.  So I started to investigate.
> >>
> >> I did the following;
> >>
> >> # fstat -u www | grep var | more
> >> www      httpd      97042    9 /var      74653 -rw-------  176907484  w
> >> www      httpd      97042   12 /var      71575 -rw-------  1345623  w
> >> www      httpd      97042   13 /var      24693 -rw-r--r--       0  w
> >> www      httpd      97042   15 /var      70919 -rw-------       0  w
> >> www      httpd      97042   16 /var      70919 -rw-------       0  w
> >> www      httpd      26059    9 /var      74653 -rw-------  176907484  w
> >> www      httpd      26059   12 /var      71575 -rw-------  1345623  w
> >>
> >> So I have an Inumber, lets search for that.
> >>
> >> # find / -inum 74653
> >> /usr/ports/net/pptpclient/files
> >>
> >> This confuses me! That is on a different slice.
> >
> > Then that is not the inode you are looking for.  Use "find -x /var ..."
> to
>
> doesnt return anything.
>
> > limit the search to just the /var mountpoint.  Your problem is probably
> > due
> > to a bad logfile rotator that isn't signalling apache to close&reopen the
> > logs, so it keeps logging to a file you have deleted.  If you're using
> > newsyslog, make sure you have listed your apache pidfile on the line
> > correspoinding to any apache logs so it knows which process to signal.
> > See
> > the newsyslog.conf manpage for more details.
>
> Added /var/run/httpd.pid to newsyslog.conf and restarted apache.
>
> I am also using cronolog.
>
> from httpd.conf:
> CustomLog "| /usr/local/sbin/cronolog
> /var/log/apache2/%Y/%m/%d/access.log" combined
>
> Thanks Patrick
>
> >
> > --
> >       Dan Nelson
> >       dnelson@allantgroup.com
> >
>
> _______________________________________________
> freebsd-questions@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "
> freebsd-questions-unsubscribe@freebsd.org"
>

Just a thought . . . perhaps your situation is similar.

I had an issue recently, where /var was maxing out quickly, even after empty
all of the logs. It ended up that I was logging too much prior to log
rotation. I had recently set-up an ftp server and the rsync of the binary I
was mirrorring slammed /var.

So, I limited what my firewall logged. Instead of *log all* I would just
*log*.


-- 
www.nealhogan.net



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?ab7b49bc0902061136j7644a335ra228915f90e75fe0>