Re: Phantom /var full messages

2004-09-11 Thread Paul Schmehl
--On Saturday, September 11, 2004 8:30 AM +0400 Sergey Zaharchenko [EMAIL PROTECTED] wrote: Actually, if the files in question are opened and unlinked, then they have no `name' in the filesystem and find(1) won't help you. Interesting. I did a find /var -inum {inode_num} and got the name of the

Re: Phantom /var full messages

2004-09-10 Thread Paul Schmehl
--On Friday, September 10, 2004 11:58:41 AM +0100 [EMAIL PROTECTED] wrote: I'm running snort 2.1.3 and mysql 3.23.58 on FreeBSD 4.9 RELEASE. All applications are built from ports. Periodically I get /var full messages and everything comes to a grinding halt. The problem is, /var isn't full. df

Re: Phantom /var full messages

2004-09-10 Thread Jerry McAllister
--On Friday, September 10, 2004 11:58:41 AM +0100 [EMAIL PROTECTED] wrote: I'm running snort 2.1.3 and mysql 3.23.58 on FreeBSD 4.9 RELEASE. All applications are built from ports. Periodically I get /var full messages and everything comes to a grinding halt. The problem is, /var

Re: Phantom /var full messages

2004-09-10 Thread Sergey Zaharchenko
On Fri, Sep 10, 2004 at 11:23:11AM -0400, Jerry McAllister probably wrote: No, you are running out of space! DF has nothing to do with it. If one of the processes grabs some file space and then unlinks, it is still holding/using that space and probably needs it, even if one method (df)

Re: Phantom /var full messages

2004-09-10 Thread Robert Huff
Jerry McAllister writes: If you are doing database stuff, then I can't imagine having a /var of less than a few GB, unless you move a lot of stuff out of /var and create links. I'll suggest part of the answer is to move that space off /var - possibly to a dedicated partition or

Re: Phantom /var full messages

2004-09-10 Thread Paul Schmehl
--On Friday, September 10, 2004 11:23:11 AM -0400 Jerry McAllister [EMAIL PROTECTED] wrote: How in the world would that help? (BTW, /var is 31GB) ^^^ Did you miss this? If you are doing database stuff, then I can't imagine having a /var of less than a few GB, unless you move a

Re: Phantom /var full messages

2004-09-10 Thread Sergey Zaharchenko
On Fri, Sep 10, 2004 at 11:57:57AM -0500, Paul Schmehl probably wrote: --On Friday, September 10, 2004 11:23:11 AM -0400 Jerry McAllister [EMAIL PROTECTED] wrote: If you are doing database stuff, then I can't imagine having a /var of less than a few GB, unless you move a lot of stuff out of

Re: Phantom /var full messages

2004-09-10 Thread Paul Schmehl
--On Friday, September 10, 2004 07:43:00 PM +0400 Sergey Zaharchenko [EMAIL PROTECTED] wrote: Correct. du can only show the `named' space (the size of files which are not unlinked-but-open). One of the ways to find out what has the largest files open is # fstat | grep /var | sort -r -n -k 8 |

Re: Phantom /var full messages

2004-09-10 Thread Robert Huff
Paul Schmehl writes: How do you convert the filenames from numbers to names? man find Robert Huff ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To

Re: Phantom /var full messages

2004-09-10 Thread Sergey Zaharchenko
On Fri, Sep 10, 2004 at 01:55:03PM -0400, Robert Huff probably wrote: Paul Schmehl writes: How do you convert the filenames from numbers to names? man find Actually, if the files in question are opened and unlinked, then they have no `name' in the filesystem and find(1) won't

Re: Phantom /var full messages

2004-09-09 Thread Bill Moran
Paul Schmehl [EMAIL PROTECTED] wrote: I'm running snort 2.1.3 and mysql 3.23.58 on FreeBSD 4.9 RELEASE. All applications are built from ports. Periodically I get /var full messages and everything comes to a grinding halt. The problem is, /var isn't full. df -h will show /var at 104%,

Re: Phantom /var full messages

2004-09-09 Thread cpghost
On Thu, Sep 09, 2004 at 11:50:36AM -0500, Paul Schmehl wrote: I'm running snort 2.1.3 and mysql 3.23.58 on FreeBSD 4.9 RELEASE. All applications are built from ports. Periodically I get /var full messages and everything comes to a grinding halt. The problem is, /var isn't full. df -h

Re: Phantom /var full messages

2004-09-09 Thread Bart Silverstrim
On Sep 9, 2004, at 1:03 PM, Bill Moran wrote: Paul Schmehl [EMAIL PROTECTED] wrote: snip I suspect this is some sort of filehandle not being released issue, but I'm not sure how to track it down. I've got lsof installed, but I'm not an expert on it yet. Any hints would be welcomed. What's

Re: Phantom /var full messages

2004-09-09 Thread Paul Schmehl
--On Thursday, September 09, 2004 05:54:16 PM +0100 Martin Hepworth [EMAIL PROTECTED] wrote: Paul who are you running du as? du will only report file sizes that it has access to. So if you don't run du as root you can get odd results... Sorry, I should have mentioned that. I'm running both df

Re: Phantom /var full messages

2004-09-09 Thread Paul Schmehl
--On Thursday, September 09, 2004 01:03:33 PM -0400 Bill Moran [EMAIL PROTECTED] wrote: Any hints would be welcomed. What's the best way to troubleshoot this problem? First, if you could isolate it to just snort or just MySQL. Typically, folks have this problem because they try to rotate log

Re: Phantom /var full messages

2004-09-09 Thread Bill Moran
Paul Schmehl [EMAIL PROTECTED] wrote: --On Thursday, September 09, 2004 01:03:33 PM -0400 Bill Moran [EMAIL PROTECTED] wrote: Any hints would be welcomed. What's the best way to troubleshoot this problem? First, if you could isolate it to just snort or just MySQL. Typically,