Re: help /var is filling up!!!
Bruno Boettcher <bboett@erm1.u-strasbg.fr> writes:
> > You really should find the real problem before you try changing
> > logging. Try something like the command 'find /var -xdev -size +5000k
> > -print'. This will print out the names of all files more than 5MB
> > (there probably shouldn't be any). Then look into the file and see if
> right.... found another big file.. daemon
> and lots of
>
> May 21 19:02:17 erm1 nmbd[8560]: refused connect from 130.79.74.176
> May 21 19:02:22 erm1 nmbd[8569]: refused connect from 130.79.74.176
> May 21 19:02:27 erm1 nmbd[8575]: refused connect from 130.79.74.176
> May 21 19:02:32 erm1 nmbd[8584]: refused connect from 130.79.74.176
That will probably cause a few MB, but I don't think it will be 60MB as
you mentioned earlier. I don't know how you shut it off.
> > there is some statement that is repeated excessively. You probably
> > have something mis-configured so that an error message is constantly
> > being logged, possibly multiple times per second. If you can't figure
> > out the message, then come back and somebody will probably be able to
> > help you.
> i already looked at the mail-logs, and they seem reasonable.... no errors,
> only correct infos...
My /var/log directory is only a little over 2MB, but mine is mostly just a
workstation for me. Just for reference, I only have 5 files over 100KB, and
the largest is only 300KB.
Since you are asking about qmail, I am assuming that you must handle
large amounts of mail, so their logs are most of your size. Going
back to your original questions, you can check into the log file
rotations by looking at the /etc/cron.*/syslog to find the current log
rotation options. You can check what is logged into each file by
looking at the /etc/syslog.conf file. Check the syslog.conf manpage
if you don't understand it. I don't use qmail, so I can't help you
except that to suggest you check the config files for qmail. 'dpkg -s
qmail' should tell you what they are.
If you really are handling enough mail volume to fill 10s of MB, then
you may just have to use a large /var directory. One idea you might
want to try is to compare the used size from 'df /var' with the result
from 'df -sx /var' and see if they are roughly the same. If they are
not, then you might have something that has unlinked an active log
file.
I hope these give you some ideas, otherwise I don't think I can help
any more.
--
Carl Johnson carlj@peak.org
Reply to: