Date: Fri, 6 Feb 2009 13:36:43 -0600 From: Neal Hogan <nealhogan@gmail.com> To: "Gelsema, P (Patrick) - FreeBSD" <freebsd@superhero.nl> Cc: Dan Nelson <dnelson@allantgroup.com>, freebsd-questions@freebsd.org Subject: Re: /var grows, apache open file, which file? Message-ID: <ab7b49bc0902061136j7644a335ra228915f90e75fe0@mail.gmail.com> In-Reply-To: <922bbbdc3563fcba8c8ed34d7fa6bf1f.squirrel@webmail.superhero.nl> References: <d518000de7090860de1b014db92acde9.squirrel@webmail.superhero.nl> <20090206190553.GB13084@dan.emsphone.com> <922bbbdc3563fcba8c8ed34d7fa6bf1f.squirrel@webmail.superhero.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Feb 6, 2009 at 1:27 PM, Gelsema, P (Patrick) - FreeBSD < freebsd@superhero.nl> wrote: > On Fri, February 6, 2009 20:05, Dan Nelson wrote: > > In the last episode (Feb 06), Gelsema, P (Patrick) - FreeBSD said: > >> I noticed that my var slice is getting eaten by apache. The amount of > >> free > >> space is getting less and less per day. So I started to investigate. > >> > >> I did the following; > >> > >> # fstat -u www | grep var | more > >> www httpd 97042 9 /var 74653 -rw------- 176907484 w > >> www httpd 97042 12 /var 71575 -rw------- 1345623 w > >> www httpd 97042 13 /var 24693 -rw-r--r-- 0 w > >> www httpd 97042 15 /var 70919 -rw------- 0 w > >> www httpd 97042 16 /var 70919 -rw------- 0 w > >> www httpd 26059 9 /var 74653 -rw------- 176907484 w > >> www httpd 26059 12 /var 71575 -rw------- 1345623 w > >> > >> So I have an Inumber, lets search for that. > >> > >> # find / -inum 74653 > >> /usr/ports/net/pptpclient/files > >> > >> This confuses me! That is on a different slice. > > > > Then that is not the inode you are looking for. Use "find -x /var ..." > to > > doesnt return anything. > > > limit the search to just the /var mountpoint. Your problem is probably > > due > > to a bad logfile rotator that isn't signalling apache to close&reopen the > > logs, so it keeps logging to a file you have deleted. If you're using > > newsyslog, make sure you have listed your apache pidfile on the line > > correspoinding to any apache logs so it knows which process to signal. > > See > > the newsyslog.conf manpage for more details. > > Added /var/run/httpd.pid to newsyslog.conf and restarted apache. > > I am also using cronolog. > > from httpd.conf: > CustomLog "| /usr/local/sbin/cronolog > /var/log/apache2/%Y/%m/%d/access.log" combined > > Thanks Patrick > > > > > -- > > Dan Nelson > > dnelson@allantgroup.com > > > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to " > freebsd-questions-unsubscribe@freebsd.org" > Just a thought . . . perhaps your situation is similar. I had an issue recently, where /var was maxing out quickly, even after empty all of the logs. It ended up that I was logging too much prior to log rotation. I had recently set-up an ftp server and the rsync of the binary I was mirrorring slammed /var. So, I limited what my firewall logged. Instead of *log all* I would just *log*. -- www.nealhogan.net
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?ab7b49bc0902061136j7644a335ra228915f90e75fe0>