Really strange ....

[David Bandel]

On 1/11/06, Ben Duncan <bns at meta3.net> wrote:
> My /var is filling up and will not come clean :
>
>
> Ok, here is my uname -ran :
>
> Linux bns 2.6.10Version_01_2005 #1 Thu Jan 6 11:51:14
>                 CST 2005 i686 unknown unknown GNU/Linux
>
> /var/log/debug is filling up, with what seems to be related
>     to some sort of keyboard / mouse error (they Work fine ) ..
>
> df -h reports :
> root at bns:var > du -h --max-depth=1
> 16K     ./lost+found
> 22M     ./log
> 472K    ./man
> 96K     ./run
> 1.6M    ./tmp
> 8.0K    ./lock
> 4.0K    ./X11R6
> 8.2M    ./spool
> 19M     ./lib
> 6.7M    ./www
> 256K    ./cache
> 28K     ./named
> 16K     ./state
> 4.0K    ./empty
> 32K     ./yp
> 1.7M    ./swaret
> 4.0K    ./proftpd
> 60M     .
>
> df, on the other hand :
> root at bns:var > df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda1             389M  182M  188M  50% /
> /dev/sdb1             5.4G  3.3G  1.8G  66% /usr
> /dev/sda5             4.4G  1.6G  2.6G  38% /opt
> /dev/sdb2             3.0G  2.1G  780M  74% /home
> /dev/sda6             2.1G  1.4G  577M  71% /export/misc
> /dev/sdc1             4.5G  1.4G  2.9G  34% /export/usr1
> /dev/sdc2             4.0G  1.6G  2.3G  40% /export/usr2
> /dev/sdd1             4.5G  2.7G  1.6G  63% /export/usr3
> /dev/sdd2             4.0G  2.4G  1.5G  62% /export/usr4
> /dev/hda1             111G   85G   21G  81% /export/ide2
> /dev/hdb1             111G   84G   22G  80% /export/ide1
> /dev/sda3             583M  380M  173M  69% /var
>
> will du on /var says:root at bns:var > du -h --max-depth=1
> 16K     ./lost+found
> 22M     ./log
> 472K    ./man
> 96K     ./run
> 1.6M    ./tmp
> 8.0K    ./lock
> 4.0K    ./X11R6
> 8.2M    ./spool
> 19M     ./lib
> 6.7M    ./www
> 256K    ./cache
> 28K     ./named
> 16K     ./state
> 4.0K    ./empty
> 32K     ./yp
> 1.7M    ./swaret
> 4.0K    ./proftpd
> 60M     .
>
> This is with /var/log/debug deleted.
>
> To get them to agree, I have to go to singe user, unmount /var
> then remount. Then they agree.
>
> When /var/ fills up and even AFTER I delete /var/log/debug,
> they system STILL thinks /var is full and does the "wierd"
> dance ....
>
> Any Ideas? Upgrade the kernel maybe ?
>

kernel upgrade, but that's not what's causing your problem -- sounds
like it's filesystem related (reiserfs perhaps?).  I seem to remember
this issue, but can't put my finger on it.  Make sure you upgrade your
filesystem tools.

What I suggest is avoiding the issue.  Why not change the
/etc/syslog.conf entry for debug.  Unless you really are debugging
something, why be that verbose?  Turn it off.

There's likely a line:
*.=debug,auth.none      -/var/log/debug
(or similar)
comment it out and restart syslog (or send it a SIGHUP)

Ciao,

David A. Bandel
--
Focus on the dream, not the competition.
            - Nemesis Air Racing Team motto