Thanks Robert,
I found the process that is creating the files, it is sysstat. It
is in /etc/corn.d.
Mike Lovins
City of Tulsa, Oklahoma
>>> [EMAIL PROTECTED] 9/1/2005 9:06:57 AM >>>
OK; You've narrowed the search down to a single directory. That's
great! But as you said, it doesn't tell you who's doing it... Or does
it?
Start with a ls -l of the directory. Who created the files? If it was
root, then you haven't narrowed it down much, but it may be some
specific userid which is associated with an application, which then
would lead to the culprit.
But maybe it's root, or another commonly used id...
Try "lsof /var/log/sa/*" and see if anything is open right now. If one
is open, then you definitely have your culprit, since the output will
list the command, userid and pid of the task with the file open.
If you still don't have a clue as to where they're coming from, then do
some forensic analysis of the content of the files. Does it list an
application? Many programs will log their name and current version to
their logs. Is there anything in the log that might tell you what the
program was doing? Database log files will contain different types of
information than file transfer log files...
If all else fails, you might be able to send a sample of the log files
to me or someone else here, and we may be able to figure out what they
are...
--
Robert P. Nix Mayo Foundation
RO-CE-8-857 200 First Street SW
507-284-0844 Rochester, MN 55905
-----
"In theory, theory and practice are the same, but
in practice, theory and practice are different."
-----Original Message-----
From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of
Mike Lovins
Sent: Wednesday, August 31, 2005 2:05 PM
To: [email protected]
Subject: Re: Disk full
Thanks...
That allowed me to trace it down, but now I don't know what
it is causing the problem. There are N U M E R I O U S files in
/var/log/sa. I dont know what is generating these files and how to
stop
it. Do you have any recommendations.
>>> [EMAIL PROTECTED] 8/29/2005 4:18:23 PM >>>
Try:
cd /var ; du -cks * | sort -rn | head -11
This will list your "culprit(s)" without having to look down the list
trying to find the largest directory. Go into the largest in the list
and do the same command again, until you find things you're willing to
remove.
I alias this command, minus the cd, as "ducks", and use it quite
often.
--
Robert P. Nix Mayo Foundation
RO-CE-8-857 200 First Street SW
507-284-0844 Rochester, MN 55905
-----
"In theory, theory and practice are the same, but
in practice, theory and practice are different."
-----Original Message-----
From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of
Jeremy Warren
Sent: Monday, August 29, 2005 2:21 PM
To: [email protected]
Subject: Re: Disk full
cd /var
du -hs *
cd <largest directory>
lather, rinse, repeat until you find the culprit(s)
Mike Lovins <[EMAIL PROTECTED]>
Sent by: Linux on 390 Port <[email protected]>
08/29/2005 03:11 PM
Please respond to Linux on 390 Port
To: [email protected]
cc:
Subject: [LINUX-390] Disk full
I have noticed that my system disk is full. I look in /var/log and
found
numerious mail.xxxxx.gz, warn.xxxxxx.gz nad messages.xxxxxx.gz files.
I
removed all of these files. I also noticed that the mail and warn
files
were very large. I ran logrotate and it reduced the file sizes and
greated more .gz files. I looked in the warn and mail files and it was
complaining about the disk was full even after removing all those
files
and compressing the other log files. Can someone point me to someother
area to look in, so these files will quit recording disk full?.
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390
or
visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390
or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390
or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390
or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390
or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
