[SunHELP] var logging option

[Sheldon T. Hall]

"Erik Parker" <eparker at mindsec.com> wrote

> I Was just curious if anyone had ever seen var fill up, without it
actually
> having files filling it :P
>
> A du -sh /var  showed 17 megs worth of data (the partition is 512 megs)..
> altho, it was 90% full..   logging was enabled in the vfstab.   A find on
the
> partition, shows only a couple of files over a meg in size (wtmp). (I also
> used a fresh find command off of the install CD).
>
> My only guess was it was something with logging in the vfstab.. I disabled
it
> (on a running system I might add, i had to kill sac and ttymon for the
time)..
> and remounted the partition.. that seemed to clear up about 80 megs of
space..
> but, it still pretty full.
>
> So, I tar'd up the contents.. unmounted it, did a newfs.. and remounted it
> (without logging).
>
> Seems fine now..  I was reading a lot of people have had problems with the
UFS
> logging option on /var  (is it because of the mass usage of /var ?)..
just
> curious if it was the ufs logs filling it up..

Do you have some sort of cron job that "rolls" the logs, or some other
procedure that moves or renames log files?

I've heard that some programs don't like to have their log files moved or
renamed while they are running, and, in retribution for our transgressions
in this regard, they keep writing to the "old" file, even though it no
longer has a name.

I think syslogd will do that.

-Shel