From owner-freebsd-questions Sat Nov 16 7:24:25 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4BE9337B401 for ; Sat, 16 Nov 2002 07:24:22 -0800 (PST) Received: from smtp.comcast.net (smtp.comcast.net [24.153.64.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id CE7C843E75 for ; Sat, 16 Nov 2002 07:24:21 -0800 (PST) (envelope-from warendaj@comcast.net) Received: from lucifer (pcp01360004pcs.benslm01.pa.comcast.net [68.80.223.127]) by mtaout01.icomcast.net (iPlanet Messaging Server 5.1 HotFix 1.5 (built Sep 23 2002)) with SMTP id <0H5O00179DGKK9@mtaout01.icomcast.net> for freebsd-questions@FreeBSD.ORG; Sat, 16 Nov 2002 10:24:21 -0500 (EST) Date: Sat, 16 Nov 2002 10:24:20 -0500 From: "J.M. Warenda" Subject: A quizical To: freebsd-questions@FreeBSD.ORG Message-id: <002701c28d84$3c236fb0$4500a8c0@lucifer> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Mailer: Microsoft Outlook Express 6.00.2800.1106 Content-type: text/plain; charset=Windows-1252 Content-transfer-encoding: 7BIT X-Priority: 3 X-MSMail-priority: Normal Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I wrote this list a few days back regarding a problem I'm having with /var reporting full. As aptly pointed out by a member of the list I did not provide much information so as to allow much perspective on my problem. About a week and a half ago now I started getting spam on my xterm about var being full: Nov 15 00:01:00 Lucretia /kernel: pid 197 (syslogd), uid 0 on /var: file system full Nov 15 00:02:50 Lucretia /kernel: pid 180 (natd), uid 0 on /var: file system full Nov 15 00:02:50 Lucretia /kernel: pid 180 (natd), uid 0 on /var: file system full Nov 15 00:05:37 Lucretia /kernel: pid 180 (natd), uid 0 on /var: file system full Nov 15 00:05:37 Lucretia /kernel: pid 180 (natd), uid 0 on /var: file system full Nov 15 00:14:31 Lucretia /kernel: pid 180 (natd), uid 0 on /var: file system full Nov 15 00:14:31 Lucretia /kernel: pid 180 (natd), uid 0 on /var: file system full Nov 15 00:24:26 Lucretia last message repeated 41 times Nov 15 00:24:26 Lucretia last message repeated 41 times Nov 15 00:34:39 Lucretia last message repeated 85 times Nov 15 00:34:39 Lucretia last message repeated 85 times Nov 15 00:43:46 Lucretia last message repeated 26 times Nov 15 00:43:46 Lucretia last message repeated 26 times Nov 15 00:54:11 Lucretia last message repeated 106 times Nov 15 00:54:11 Lucretia last message repeated 106 times This machine is running very few things ... it had been running Apache which in the past has filled var on me, but I've since removed Apache and cleared out the logs. I'm not even sure where / what natd is logging, and this is where I come to my quandry. I've been running FreeBSD in one form or another since early '98, but tending to /var is something I'm still quite the newbie at ... and there are plenty of other areas where that is true. This system is my house's natd gateway for sharing the cable modem on the LAN ... it runs ftpd, telnetd, sshd, ezbounce (for identing to EFNet), and smbd (set to only allow connections from 192.168.0.*) I also have X and a few apps (xchat, Mozilla). The system itself is a Pentium 166 with 64 megs of ram and two Netgear FA311 NICs. The problem comes here ... and I'm certain this has something to do with something I overlooked or configured improperly, but I'm not sure how / what ... df reports the following: Lucretia# df Filesystem 1K-blocks Used Avail Capacity Mounted on /dev/ad0s1a 198399 54224 128304 30% / /dev/ad0s1f 2530542 2229103 98996 96% /usr /dev/ad0s1e 99183 99068 -7819 109% /var procfs 4 4 0 100% /proc Showing /var at 109% capacity, over 99 megs. The thing is this ... du feels differently ... Lucretia# du -sk * 1 account 3 at 9 backups 2 crash 2 cron 562 db 62 games 1 heimdal 489 log 29 mail 2 msgs 1 preserve 53 run 1 rwho 17 spool 2 tmp 20 yp Little over a meg ... not nearly 100. So the question becomes where's the beef? I've scoured and scoured and finally just read the output of a ls -laR in /var and found no discrepancy revealing where the other 98megs are. I've run fsck -f but that changed nothing ... I'm almost certain I'm making some newbie mistake, and certain I'll be embarassed by the answers, but I prefer embarasment to doing things wrong unceasingly :-P Any input would be apprechiated. I'm quite baffled as to why I can't find this supposed 98 megs that are on that file system ..... -John To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message