Prev: Solaris 10 installation and RAID config
Next: Anyone using ZFS on a Dell 1850 w/ LSI Megaraid?
From: neilsolent on 9 Sep 2009 03:55
We have a Solaris 8 SPARC Sun-Fire-V440 system (I know, very old). But
it is very critical to us.

Filesystem /var seems to have become corrupt - "df -k" reports it 100%
full in terms of diskspace (inodes at 3%) but the size of the files is
not enough to account for this (5GB) of space usage. Hence deleting
files won't help.

We had some trouble a while back - deleting an old core dump in /var/
cores to free space caused the system to crash. After some fsck and
lower-level work the system was eventually brought back up.

We could reboot it now - fsck would run on /var and *might* help - but
we are not sure the system will come up!

Questions are: is it possible/worthwhile to recreate /var afresh, and
how could this be done?

Many thanks in advance
From: hume.spamfilter on 9 Sep 2009 05:00
neilsolent <n(a)solenttechnology.co.uk> wrote:
> Filesystem /var seems to have become corrupt - "df -k" reports it 100%
> full in terms of diskspace (inodes at 3%) but the size of the files is
> not enough to account for this (5GB) of space usage. Hence deleting
> files won't help.

You've got some process holding a deleted file open, most likely. Use
pfiles or lsof, and look for a file that is supposedly open but doesn't
exist.

First thing to try is to HUP syslogd, of course.

> Questions are: is it possible/worthwhile to recreate /var afresh, and
> how could this be done?

It would be an extreme hassle, and you'd need to reboot. Check for open,
deleted files first.

--
Brandon Hume - hume -> BOFH.Ca, http://WWW.BOFH.Ca/
From: neilsolent on 9 Sep 2009 06:17
> You've got some process holding a deleted file open, most likely.  Use
> pfiles or lsof, and look for a file that is supposedly open but doesn't
> exist.
>
> First thing to try is to HUP syslogd, of course.
>
> > Questions are: is it possible/worthwhile to recreate /var afresh, and
> > how could this be done?
>
> It would be an extreme hassle, and you'd need to reboot.  Check for open,
> deleted files first.

I ran the following, and it lists a few files of course, but nothing
that has been supposedly deleted and nothing large:

lsof +D /var

Bring on the hassle please :-)
From: hume.spamfilter on 9 Sep 2009 07:12
neilsolent <n(a)solenttechnology.co.uk> wrote:
> Bring on the hassle please :-)

Well, first-off, do you have the disk space/slices available to build a new
/var onto?

--
Brandon Hume - hume -> BOFH.Ca, http://WWW.BOFH.Ca/
From: hume.spamfilter on 9 Sep 2009 07:15
neilsolent <n(a)solenttechnology.co.uk> wrote:
> Bring on the hassle please :-)

In addition, perhaps you should just reboot. You'll need to do so anyway
to get a new /var working (because of /var/adm/{u,w}tmp{x,}).

It would be annoying to go through all that work only to find out that a
plain reboot would have fixed the problem.

Personally, I strongly suspect that there's still a file there that you
haven't seen.

--
Brandon Hume - hume -> BOFH.Ca, http://WWW.BOFH.Ca/
 |  Next  |  Last
Pages: 1 2 3 4
Prev: Solaris 10 installation and RAID config
Next: Anyone using ZFS on a Dell 1850 w/ LSI Megaraid?