OK; You've narrowed the search down to a single directory. That's great! But as you said, it doesn't tell you who's doing it... Or does it?
Start with a ls -l of the directory. Who created the files? If it was root, then you haven't narrowed it down much, but it may be some specific userid which is associated with an application, which then would lead to the culprit. But maybe it's root, or another commonly used id... Try "lsof /var/log/sa/*" and see if anything is open right now. If one is open, then you definitely have your culprit, since the output will list the command, userid and pid of the task with the file open. If you still don't have a clue as to where they're coming from, then do some forensic analysis of the content of the files. Does it list an application? Many programs will log their name and current version to their logs. Is there anything in the log that might tell you what the program was doing? Database log files will contain different types of information than file transfer log files... If all else fails, you might be able to send a sample of the log files to me or someone else here, and we may be able to figure out what they are... -- Robert P. Nix Mayo Foundation RO-CE-8-857 200 First Street SW 507-284-0844 Rochester, MN 55905 ----- "In theory, theory and practice are the same, but in practice, theory and practice are different." -----Original Message----- From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of Mike Lovins Sent: Wednesday, August 31, 2005 2:05 PM To: [email protected] Subject: Re: Disk full Thanks... That allowed me to trace it down, but now I don't know what it is causing the problem. There are N U M E R I O U S files in /var/log/sa. I dont know what is generating these files and how to stop it. Do you have any recommendations. >>> [EMAIL PROTECTED] 8/29/2005 4:18:23 PM >>> Try: cd /var ; du -cks * | sort -rn | head -11 This will list your "culprit(s)" without having to look down the list trying to find the largest directory. Go into the largest in the list and do the same command again, until you find things you're willing to remove. I alias this command, minus the cd, as "ducks", and use it quite often. -- Robert P. Nix Mayo Foundation RO-CE-8-857 200 First Street SW 507-284-0844 Rochester, MN 55905 ----- "In theory, theory and practice are the same, but in practice, theory and practice are different." -----Original Message----- From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of Jeremy Warren Sent: Monday, August 29, 2005 2:21 PM To: [email protected] Subject: Re: Disk full cd /var du -hs * cd <largest directory> lather, rinse, repeat until you find the culprit(s) Mike Lovins <[EMAIL PROTECTED]> Sent by: Linux on 390 Port <[email protected]> 08/29/2005 03:11 PM Please respond to Linux on 390 Port To: [email protected] cc: Subject: [LINUX-390] Disk full I have noticed that my system disk is full. I look in /var/log and found numerious mail.xxxxx.gz, warn.xxxxxx.gz nad messages.xxxxxx.gz files. I removed all of these files. I also noticed that the mail and warn files were very large. I ran logrotate and it reduced the file sizes and greated more .gz files. I looked in the warn and mail files and it was complaining about the disk was full even after removing all those files and compressing the other log files. Can someone point me to someother area to look in, so these files will quit recording disk full?. ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
