On Wed, Jan 30, 2013 at 12:54:25PM +0000, Bonno Bloksma wrote: > Hi, > > I had a problem that generated A LOT of messages in syslog and it grew untill > the entire /var partition had 0 bytes free. > The /var/log/syslog file was over 4GB large. I deleted it using a simple rm > /var/log/syslog command and the file is indeed no longer there. > The du /var/log -s command shows a decrease of over 4GB so that seems to > confirm it but.... > > There are still 0 bytes free on the /var partition as the df command shows. > root@linutr:~# df > Filesystem 1K-blocks Used Available Use% Mounted on > /dev/mapper/vgroup1-lvroot > 4805760 1306860 3254780 29% / > tmpfs 3058148 0 3058148 0% /lib/init/rw > udev 3052820 184 3052636 1% /dev > tmpfs 3058148 0 3058148 0% /dev/shm > /dev/cciss/c0d0p1 282599 28719 239288 11% /boot > /dev/mapper/vgroup1-lvusr > 4805760 472984 4088656 11% /usr > /dev/mapper/vgroup1-lvvar > 9611492 9611492 0 100% /var > root@linutr:~# > > Also there is still no nerw syslog file, probably because the filesystem > shows 0 bytes free. > /var is an ext3 partition > > Should I just unmount /var, and run fsck.ext3 /var or is there something else > I should do first? > Is there maybe some background process that is still running through all > inodes freeing up the 4+GB diskspace?
Restart your syslog daemon. Although you've done "rm /var/log/syslog" all that has done is removed the directory entry. Your syslog still has a file-handle to that file and is trying to write to it. Linux takes the view that, although you've deleted the file, it won't disappear if you're still using it. This is very useful for temporary files (create a file, open it, delete it and no-one else can overwrite it). If you restart your syslogd, that will close the file-handle to the old file (and so the file will now disappear) and re-open a new syslog file.
signature.asc
Description: Digital signature
