[NTLUG:Discuss] /var out of space-Still-....help please

[Dan Carlson]

You might want to try manually killing logrotate, syslogd and klogd,
manually deleting /var/log/news and /var/log/mail, and reinstalling the
10/10/2000 logrotate/sysklogd updates.  Obviously, your situation may be
different from mine, but what you have described sounds very similar, i.e.
/var getting very large and logrotate not terminating and using up a lot of
CPU time.  Where exactly within /var did the space go on your system?

After the manual cleanup and installing the latest updates the problem has
not recurred on my system.  The rpm updates should kill the processes for
you, but they won't delete the offending directories.  In my case one of the
directories was 10 MB and the other was 12 MB.  These were the sizes of the
directory files themselves, not the size of their content!  I was unable to
switch into either of these directories, so I don't know how many files each
contained, but the numbers had to be extremely large.  I would execute a cd
command to switch into them, but after several HOURS of waiting, the command
still hadn't completed and I would have to kill it.

If this doesn't fix it on your system then consider just removing logrotate
from your /etc/cron.daily directory (or from wherever its getting run from
on your system) so it can't cause further trouble.  This ought to at least
allow you to avoid reinstalling, although you would have to live without log
rotation or find another way to do it.  After going through this myself I'm
about as impressed with logrotate as I have been with gpm...

Dan Carlson

----- Original Message -----
From: "./aal" <al_h at technologist.com>
To: <discuss at ntlug.org>
Sent: Thursday, October 19, 2000 6:26 PM
Subject: Re: [NTLUG:Discuss] /var out of space-Still-....help please


> Dan Carlson wrote:
> >
> > This could be caused by a problem with logrotate, where it continually
> > archives files in /var/log/news and /var/log/mail.  This problem occured
on
> > my system, consuming several hundred megabytes of disk space before I
found
> > it.  Here is Mandrake's advisory on the problem:
> >
> > http://www.linux-mandrake.com/en/security/MDKA-2000-009-1.php3?dis=7.1
>
>
>
> close....
> I have already applied those updates, before this problem arose.
>
> I cant print, logrotate sucks up all my processor, is it time to apply
> the MS solution(wipe and start over)?
>
> completely lost
> ./aal
> _______________________________________________
> http://ntlug.org/mailman/listinfo/discuss
>