disk full (error log loop)

[w trillich <will@pinncomp.net>]

okay. it's my fault. i let the log file get huge--but deleting
it doesn't recover the space on the partition!

i made a reference in a perl script, called by the httpd server
(apache 1.3.9), that was undefined, and "perl -w" logged it
to the /var/log/apache/error.log file.

for some reason it logged and logged and logged that error
until it ate up the whole partition. i'll figure that out,
later.

so two apache processes are spinning their wheels trying
to log this error to a full partition. no problem:
	# apachectl restart
poof, the troublesome apache children went away, and all is well
again in web-land.

after checking error.log to see if any useful info was in
there (yeah, right), i do:
	# df
	Filesystem           1k-blocks      Used Available Use% Mounted on
	/dev/hda1               101075     47411     48445  49% /
	/dev/hda7              2695175    599462   1956351  23% /usr
	/dev/hda6               987220    936228         0 100% /var
	# cd /var/log/apache
	# ls -l error.log
	-rw-r--r-- 1 www-data www-data 437281392 Apr 26 22:00 apache/error.log
(cool! 437 [decimal] megabytes in one text file!)
	# rm error.log
	# ls -l error.log
	ls: error.log: No such file or directory

even so, apache may still have a filehandle open to the file, so:

	# apachectl restart
	/usr/sbin/apachectl restart: httpd restarted
	# sync

hell, let's be paranoid and shut it down completely:

	# apachectl stop
	/usr/sbin/apachectl stop: httpd stopped
	# apachectl stop
	/usr/sbin/apachectl stop: httpd (no pid file) not running
	# ps ax | grep apache
	 9747 ttyp0    S      0:00 grep apache

yup. it's dead, jim.

	# apachectl start
	/usr/sbin/apachectl start: httpd started
	# sync

now we should have over half our /var partition free again, right?

	# df
	Filesystem           1k-blocks      Used Available Use% Mounted on
	/dev/hda1               101075     47411     48445  49% /
	/dev/hda7              2695175    599462   1956351  23% /usr
	/dev/hda6               987220    936228         0 100% /var
	# df -m
	Filesystem           1M-blocks      Used Available Use% Mounted on
	/dev/hda1                   99        46        47  49% /
	/dev/hda7                 2632       585      1910  23% /usr
	/dev/hda6                  964       914         0 100% /var

i'm guessing that another process actually has the file open?
which one--or how could i find that out, myself?

if not, then--help!