Really strange ....

[Net Llama!]

On Wed, 11 Jan 2006, Ben Duncan wrote:
> My /var is filling up and will not come clean :
>
>
> Ok, here is my uname -ran :
>
> Linux bns 2.6.10Version_01_2005 #1 Thu Jan 6 11:51:14
>                 CST 2005 i686 unknown unknown GNU/Linux
>
> /var/log/debug is filling up, with what seems to be related
>     to some sort of keyboard / mouse error (they Work fine ) ..
>
> df -h reports :
> root at bns:var > du -h --max-depth=1
> 16K     ./lost+found
> 22M     ./log
> 472K    ./man
> 96K     ./run
> 1.6M    ./tmp
> 8.0K    ./lock
> 4.0K    ./X11R6
> 8.2M    ./spool
> 19M     ./lib
> 6.7M    ./www
> 256K    ./cache
> 28K     ./named
> 16K     ./state
> 4.0K    ./empty
> 32K     ./yp
> 1.7M    ./swaret
> 4.0K    ./proftpd
> 60M     .
>
> df, on the other hand :
> root at bns:var > df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda1             389M  182M  188M  50% /
> /dev/sdb1             5.4G  3.3G  1.8G  66% /usr
> /dev/sda5             4.4G  1.6G  2.6G  38% /opt
> /dev/sdb2             3.0G  2.1G  780M  74% /home
> /dev/sda6             2.1G  1.4G  577M  71% /export/misc
> /dev/sdc1             4.5G  1.4G  2.9G  34% /export/usr1
> /dev/sdc2             4.0G  1.6G  2.3G  40% /export/usr2
> /dev/sdd1             4.5G  2.7G  1.6G  63% /export/usr3
> /dev/sdd2             4.0G  2.4G  1.5G  62% /export/usr4
> /dev/hda1             111G   85G   21G  81% /export/ide2
> /dev/hdb1             111G   84G   22G  80% /export/ide1
> /dev/sda3             583M  380M  173M  69% /var
>
> will du on /var says:root at bns:var > du -h --max-depth=1
> 16K     ./lost+found
> 22M     ./log
> 472K    ./man
> 96K     ./run
> 1.6M    ./tmp
> 8.0K    ./lock
> 4.0K    ./X11R6
> 8.2M    ./spool
> 19M     ./lib
> 6.7M    ./www
> 256K    ./cache
> 28K     ./named
> 16K     ./state
> 4.0K    ./empty
> 32K     ./yp
> 1.7M    ./swaret
> 4.0K    ./proftpd
> 60M     .
>
> This is with /var/log/debug deleted.
>
> To get them to agree, I have to go to singe user, unmount /var
> then remount. Then they agree.
>
> When /var/ fills up and even AFTER I delete /var/log/debug,
> they system STILL thinks /var is full and does the "wierd"
> dance ....
>
> Any Ideas? Upgrade the kernel maybe ?

Yes, upgrade the kernel, if for no other reason than to address the
numerous stability & security issues with 2.6.10.

I'd also suggest running some kind of file system check on the
/var/partition.  What kind of filesystem are you using?

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Lonni J Friedman                        netllama at linux-sxs.org
LlamaLand				http://netllama.linux-sxs.org