[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [cobalt-users] /var filling up
- Subject: Re: [cobalt-users] /var filling up
- From: Jason McNew <jason@xxxxxxxxxxxxx>
- Date: Tue Jan 25 06:44:25 2000
- Organization: ClearSail Communications
all right, I figured it out. Here is the rundown:
I connected via null modem cable to the serial port to log in. From some
reason it would let my su from the serial port but not through a network
connection. I haven't figured out why, but it worked for me.
After logging in, I started grepping through the message log to see if I could
find the problem
cd /var/log
grep log messages
This didn't come up with anything. I figured the best way to free up some
room was to simply free up some space. After deleting the old .gz files from
previous log rotations, I had enough free space in /var that the system was
running ok again.
rm messages.*.gz
rm maillog.*.gz
This of course was only a temporary fix. So I did some digging through /etc
to figure out exactly what was wrong with the log rotation.
cd /etc
ls -l |grep log
[snip]
-rw-r--r-- 1 root root 578 May 28 1999 logrotate.conf.master
[snip]
Looks like a winner. After reading
man logrotate
and through all the cron files (/etc/crontab, /etc/cron.*) I had a better
understanding of how the system works. Nice setup, btw. I like it. Anyway,
I ran log rotate manually using
/usr/sbin/logrotate /etc/logrotate.conf.master
And it gave me an error (I can't remember exactly how it went but it was
something along the lines of this)
site85: no such file or directory
and it quit.
Ah, it seems that it's trying to rotate the logs in a home diretory that no
longer exists. Either there is a bug in the web management software that
caused it not to remove this entry, or the previous sysadmin had deleted the
site's home directory by hand. Oh well.
For posterity:
mv /etc/logrotate.d/site85 /root
/usr/sbin/logrotate /etc/logrotate.conf.master
[wait about 20 minutes on a large site]
And my disk usage in /var dropped back down to normal levels.
Jason McNew wrote:
> Argh! I've hit the same problem as annother fellow on this list. I can't
> su, and therefore can't view the log, and can't get log rotation going. I
> guess it's time to pester tech support. :-\
>
> Mark Spieth wrote:
>
> > Your problem is that maillog is not rotating.
> >
> > -rw-r----- 1 root mail 16173056 Jan 22 23:30 maillog
> >
> > Looks like the last time maillog rotated was September 3rd. Look at
> > logrotate and /var/log/messages to determine why its not rotating.
> >
> > Mark
> > -----Original Message-----
> > From: cobalt-users-admin@xxxxxxxxxxxxxxx
> > [mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Jason McNew
> > Sent: Monday, January 24, 2000 11:08 AM
> > To: cobalt-users@xxxxxxxxxx
> > Subject: [cobalt-users] /var filling up
> >
> > in particular, /var/log and /var/cobalt are verry big. It looks like
> > the log files are not being rotated. They are supposed to be rotated by
> > size, right? What should I check to find the problem?
> >
> > [root /var]# df
> > Filesystem 1024-blocks Used Available Capacity Mounted on
> > /dev/hda1 495745 252333 243412 51% /
> > /dev/hda3 198601 198601 0 100% /var
> > /dev/hda4 11424230 5409699 6014531 47% /home
> > [root /var]# cd log
> > [root log]# ls -l
> > total 121277
> > -rw-r--r-- 1 root root 63067136 Jan 24 02:57 analog.dns
> > -rw-r--r-- 1 root root 19233792 Jan 24 12:01 cron
> > -rw-r--r-- 1 root root 87088 Aug 30 01:06 cron.1.gz
> > -rw-r--r-- 1 root root 2746 Jan 20 19:28 dmesg
> > lrwxrwxrwx 1 root root 15 May 28 1999 httpd ->
> > /home/log/httpd
> > -rw-r--r-- 1 root root 108916 Jan 24 11:37 lastlog
> > -rw-r----- 1 root mail 16173056 Jan 22 23:30 maillog
> > -rw-r----- 1 root mail 83233 Sep 3 01:00 maillog.1.gz
> > -rw-r----- 1 root mail 3412992 Jan 23 17:15 messages
> > -rw------- 1 root root 91910 Sep 4 01:00 messages.1.gz
> > -rw-r--r-- 1 root root 825 Jan 20 19:28 mgetty.log.modem
> > -rw-r--r-- 1 root root 0 May 28 1999 samba
> > -rw------- 1 root root 5127168 Jan 22 21:43 secure
> > -rw------- 1 root root 100078 Aug 23 01:00 secure.1.gz
> > -rw-r--r-- 1 root root 616 Jan 24 12:00 sendmail.st
> > -rw------- 1 root root 0 May 28 1999 spooler
> > -rw-r--r-- 1 root root 6982656 Jan 24 12:01 wtmp
> > -rw------- 1 root root 8159232 Jan 24 12:01 xferlog
> > -rw------- 1 root root 1158256 Aug 27 21:30 xferlog.1
> > [root cobalt]# ls -l
> > total 74020
> > -rw-r--r-- 1 root root 2684928 Jan 24 12:00 adm.log
> > -rw-r--r-- 1 root root 503 Sep 4 01:00 adm.log.1.gz
> > -rw-r--r-- 1 root root 0 May 28 1999 atalk.log
> > -rw-r--r-- 1 root root 2252800 Jan 24 12:00 cpu.log
> > -rw-r--r-- 1 root root 640 Sep 4 01:00 cpu.log.1.gz
> > -rw-r--r-- 1 root root 15055872 Jan 24 12:00 crond.log
> > -rw-r--r-- 1 root root 2055 Sep 4 01:03 crond.log.1.gz
> > -rw-r--r-- 1 root root 2508800 Jan 24 12:00 custo.log
> > -rw-r--r-- 1 root root 508 Sep 4 01:00 custo.log.1.gz
> > -rw-r--r-- 1 root root 5368832 Jan 24 12:00 dns.log
> > -rw-r--r-- 1 root root 826 Sep 4 01:00 dns.log.1.gz
> > -rw-r--r-- 1 root root 4941824 Jan 24 12:00 filesystem.log
> > -rw-r--r-- 1 root root 1699 Sep 4 01:00
> > filesystem.log.1.gz
> > -rw-r--r-- 1 root root 2752512 Jan 24 12:00 ftp.log
> > -rw-r--r-- 1 root root 508 Sep 4 01:00 ftp.log.1.gz
> > -rw-r--r-- 1 root root 1545216 Jan 24 12:00 groupspace.log
> > -rw-r--r-- 1 root root 716 Sep 4 01:00
> > groupspace.log.1.gz
> > -rw-r--r-- 1 root root 2495488 Jan 24 12:00 inetd.log
> > -rw-r--r-- 1 root root 508 Sep 4 01:00 inetd.log.1.gz
> > -rw-r--r-- 1 root root 2332672 Jan 24 12:00 lcd.log
> > -rw-r--r-- 1 root root 494 Sep 4 01:00 lcd.log.1.gz
> > -rw-r--r-- 1 root root 6514688 Jan 24 12:00 mail.log
> > -rw-r--r-- 1 root root 1096 Sep 4 01:00 mail.log.1.gz
> > -rw-r--r-- 1 root root 4034560 Jan 24 12:00 mem.log
> > -rw-r--r-- 1 root root 1345 Sep 4 01:00 mem.log.1.gz
> > -rw-r--r-- 1 root root 0 May 28 1999 modem.log
> > -rw-r--r-- 1 root root 3520512 Jan 24 12:00 net.log
> > -rw-r--r-- 1 root root 1306 Sep 4 01:00 net.log.1.gz
> > -rw-r--r-- 1 root root 0 May 28 1999 nfs.log
> > -rw-r--r-- 1 root root 0 May 28 1999 ntp.log
> > -rw-r--r-- 1 root root 6640640 Jan 24 12:00 portmap.log
> > -rw-r--r-- 1 root root 874 Sep 4 01:00 portmap.log.1.gz
> > -rw-r--r-- 1 root root 920576 Jan 24 01:07 sauce.log
> > -rw-r--r-- 1 root root 0 May 28 1999 smb.log
> > -rw-r--r-- 1 root root 3143680 Jan 24 12:00 snmp.log
> > -rw-r--r-- 1 root root 518 Sep 4 01:00 snmp.log.1.gz
> > -rw-r--r-- 1 root root 0 May 28 1999 ssl.log
> > -rw-r--r-- 1 root root 90112 Jan 24 12:00 status
> > -rw-r--r-- 1 root root 4786176 Jan 24 12:00 telnet.log
> > -rw-r--r-- 1 root root 804 Sep 4 01:00 telnet.log.1.gz
> > drwx------ 2 root root 1024 Jan 21 13:09 tmp
> > -rw-r--r-- 1 root root 3 Jan 22 11:14 uid
> > -rw------- 1 root root 90112 Jan 24 11:42 uidb
> > -rw-r--r-- 1 root root 1540096 Jan 24 12:00 userspace.log
> > -rw-r--r-- 1 root root 705 Sep 4 01:00
> > userspace.log.1.gz
> > -rw-r--r-- 1 root root 2265088 Jan 24 12:00 www.log
> > -rw-r--r-- 1 root root 488 Sep 4 01:00 www.log.1.gz
> >
> > if it helps, here is the software I've installed:
> > Cobalt OS Release 4.0
> > RaQ2-Security Release 1.0
> > RaQ2-Security Release 1.4
> > RaQ2-Security Release 2.0
> > RaQ2-Security Release 2.1
> > RaQ2-Security Release 2.2
> > RaQ2-Security Release 2.3
> > RaQ2-Security Release 2.7
> > RaQ2-Security Release 2.93
> > RaQ2-Update-MFG Release 2.1
> > RaQ2-Update-OS Release 1.0
> >