Re: /var full

[Steven Ayre <steveayre@gmail.com>]

> Also there is still no nerw syslog file, probably because the filesystem shows 0 bytes free.

The reason for this is the syslog-ng daemon still has a handle open to the old file (which as already has been mentioned is why the partition was still full).

If you are going to delete the file, you need to restart the syslog-ng service too which'll reopen the file. Sending the HUP signal should be enough too. It'll create a new file then.

Though as you say it'll probably need a small amount of free space to do so, but restarting the service would probably close all the remaining handles and release the 4GB. If it didn't the lsof command can tell you what still has it open.

You might want to check your logrotate settings are ok, although perhaps it grew too quickly for that to react.

Steve



On 30 Jan 2013, at 12:54, Bonno Bloksma <b.bloksma@tio.nl> wrote:

> Also there is still no nerw syslog file, probably because the filesystem shows 0 bytes free.
> /var is an ext3 partition