Skip site navigation (1)Skip section navigation (2)
Date:      09 Jun 2002 19:53:46 +0100
From:      "S. Roberts" <sroberts@dsl.pipex.com>
To:        FreeBSD-Questions <freebsd-questions@freebsd.org>
Subject:   Strange size increase in /var
Message-ID:  <1023648827.318.73.camel@Demon.Strobe.org>

next in thread | raw e-mail | index | archive | help

--=-R6QQuIMzXl7wr0c+bAU6
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Hello,
     Over the last two days, I've noticed a significant increase in the
size of /var on this system:
# df -k
Filesystem  1K-blocks    Used   Avail Capacity  Mounted on
/dev/ad0s1a    148823   42962   93956    31%    /
/dev/ad0s1f  11789353 1527589 9318616    14%    /usr
/dev/ad0s1e    297663   51443  222407    19%    /var
procfs              4       4       0   100%    /proc
#=20

Normally /var would come in at around 13% - 14%, as was the case this
time last week, I believe.

Here's what du returns:
# pwd
/var
# du -h -d0
 50M	.
# du -h -d1
1.0K	./account
3.0K	./at
 11K	./backups
2.0K	./crash
3.0K	./cron
 24M	./db
1.0K	./heimdal
 14M	./log
1.0K	./mail
2.0K	./msgs
1.0K	./preserve
 56K	./run
1.0K	./rwho
 11M	./spool
2.0K	./tmp
 20K	./yp
 62K	./games
2.0K	./lib
 50M	.
#
I am running IPFW for those who would ask:
# dmesg | grep log
IP packet filtering initialized, divert enabled, rule-based forwarding
disabled, default to deny, logging limited to 10 packets/entry by
default
#=20

Here's what's in /var:
# ls -la
total 21
drwxr-xr-x  20 root    wheel    512 Apr 14 13:47 .
drwxr-xr-x  19 root    wheel   1024 May 27 01:20 ..
drwxr-xr-x   2 root    wheel    512 Sep 18  2001 account
drwxr-xr-x   4 root    wheel    512 Sep 18  2001 at
drwxr-x---   2 root    wheel    512 Apr 28 03:01 backups
drwxr-x---   2 root    wheel    512 Feb 11 01:53 crash
drwxr-x---   3 root    wheel    512 Sep 18  2001 cron
drwxr-xr-x   6 root    wheel    512 May 30 22:23 db
drwxrwxr-x   5 root    games    512 Feb 11 01:53 games
drwx------   2 root    wheel    512 Sep 18  2001 heimdal
drwxr-xr-x   3 root    wheel    512 Apr 14 13:47 lib
drwxr-xr-x   3 root    wheel   1536 Jun  9 05:00 log
drwxrwxr-x   2 root    mail     512 May 31 18:14 mail
drwxr-xr-x   2 daemon  wheel    512 Feb 11 02:20 msgs
drwxr-xr-x   2 root    wheel    512 Sep 18  2001 preserve
drwxr-xr-x   3 root    wheel    512 Jun  9 15:37 run
drwxrwxr-x   2 root    daemon   512 Sep 18  2001 rwho
drwxr-xr-x  12 root    wheel    512 May 10 20:24 spool
drwxrwxrwt   3 root    wheel    512 Jun  9 13:21 tmp
drwxr-xr-x   2 root    wheel    512 May 26 12:40 yp
#=20
And in checking individual dirs, I would have thought log to be the
usual suspect in this situation:
# cd log
# du -h -d0
 14M	.
#=20
Here's what's in db:
# du -h -d0
 24M	.
#=20

At this point (sorry if I appear too thick) I'm not sure of what else I
could look at, but I am willing to provide some logs / configs to anyone
who is willing to help me get to the bottom of this.
Thanks for the time.

Stacey

--=20
Stacey Roberts B.Sc. (HONS) Computer Science
Network Systems Engineer

--=-R6QQuIMzXl7wr0c+bAU6
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Hello,
     Over the last two days, I've noticed a significant increase in the
size of /var on this system:
# df -k
Filesystem  1K-blocks    Used   Avail Capacity  Mounted on
/dev/ad0s1a    148823   42962   93956    31%    /
/dev/ad0s1f  11789353 1527589 9318616    14%    /usr
/dev/ad0s1e    297663   51443  222407    19%    /var
procfs              4       4       0   100%    /proc
#=20

Normally /var would come in at around 13% - 14%, as was the case this
time last week, I believe.

Here's what du returns:
# pwd
/var
# du -h -d0
 50M	.
# du -h -d1
1.0K	./account
3.0K	./at
 11K	./backups
2.0K	./crash
3.0K	./cron
 24M	./db
1.0K	./heimdal
 14M	./log
1.0K	./mail
2.0K	./msgs
1.0K	./preserve
 56K	./run
1.0K	./rwho
 11M	./spool
2.0K	./tmp
 20K	./yp
 62K	./games
2.0K	./lib
 50M	.
#
I am running IPFW for those who would ask:
# dmesg | grep log
IP packet filtering initialized, divert enabled, rule-based forwarding
disabled, default to deny, logging limited to 10 packets/entry by
default
#=20

Here's what's in /var:
# ls -la
total 21
drwxr-xr-x  20 root    wheel    512 Apr 14 13:47 .
drwxr-xr-x  19 root    wheel   1024 May 27 01:20 ..
drwxr-xr-x   2 root    wheel    512 Sep 18  2001 account
drwxr-xr-x   4 root    wheel    512 Sep 18  2001 at
drwxr-x---   2 root    wheel    512 Apr 28 03:01 backups
drwxr-x---   2 root    wheel    512 Feb 11 01:53 crash
drwxr-x---   3 root    wheel    512 Sep 18  2001 cron
drwxr-xr-x   6 root    wheel    512 May 30 22:23 db
drwxrwxr-x   5 root    games    512 Feb 11 01:53 games
drwx------   2 root    wheel    512 Sep 18  2001 heimdal
drwxr-xr-x   3 root    wheel    512 Apr 14 13:47 lib
drwxr-xr-x   3 root    wheel   1536 Jun  9 05:00 log
drwxrwxr-x   2 root    mail     512 May 31 18:14 mail
drwxr-xr-x   2 daemon  wheel    512 Feb 11 02:20 msgs
drwxr-xr-x   2 root    wheel    512 Sep 18  2001 preserve
drwxr-xr-x   3 root    wheel    512 Jun  9 15:37 run
drwxrwxr-x   2 root    daemon   512 Sep 18  2001 rwho
drwxr-xr-x  12 root    wheel    512 May 10 20:24 spool
drwxrwxrwt   3 root    wheel    512 Jun  9 13:21 tmp
drwxr-xr-x   2 root    wheel    512 May 26 12:40 yp
#=20
And in checking individual dirs, I would have thought log to be the
usual suspect in this situation:
# cd log
# du -h -d0
 14M	.
#=20
Here's what's in db:
# du -h -d0
 24M	.
#=20

At this point (sorry if I appear too thick) I'm not sure of what else I
could look at, but I am willing to provide some logs / configs to anyone
who is willing to help me get to the bottom of this.
Thanks for the time.

Stacey

- --=20
Stacey Roberts B.Sc. (HONS) Computer Science
Network Systems Engineer

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQA/AwUBPQOkOvdn4A8qiCO5EQIiVACg/WOBB46Z7sZVNOmUboHDfbuOM4sAn0aL
j15yXx1Ff5U+q/d7Gn+8cT8t
=mThc
-----END PGP SIGNATURE-----

--=-R6QQuIMzXl7wr0c+bAU6--


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1023648827.318.73.camel>