Phantom /var full messages

[Bart Silverstrim]

On Sep 9, 2004, at 1:03 PM, Bill Moran wrote:

> Paul Schmehl <pauls at utdallas.edu> wrote:
<snip>
>
>> I suspect this is some sort of filehandle not being released issue, 
>> but I'm
>> not sure how to track it down.  I've got lsof installed, but I'm not 
>> an
>> expert on it yet.
>>
>> Any hints would be welcomed.  What's the best way to troubleshoot this
>> problem?
>
> First, if you could isolate it to just snort or just MySQL.

Use "lsof" and grep to figure out what file handles are still open by 
mysqld and/or snort.  Might narrow it down for you.

-Bart