/var grows, apache open file, which file?

[Neal Hogan]

On Fri, Feb 6, 2009 at 1:27 PM, Gelsema, P (Patrick) - FreeBSD <
freebsd at superhero.nl> wrote:

> On Fri, February 6, 2009 20:05, Dan Nelson wrote:
> > In the last episode (Feb 06), Gelsema, P (Patrick) - FreeBSD said:
> >> I noticed that my var slice is getting eaten by apache. The amount of
> >> free
> >> space is getting less and less per day.  So I started to investigate.
> >>
> >> I did the following;
> >>
> >> # fstat -u www | grep var | more
> >> www      httpd      97042    9 /var      74653 -rw-------  176907484  w
> >> www      httpd      97042   12 /var      71575 -rw-------  1345623  w
> >> www      httpd      97042   13 /var      24693 -rw-r--r--       0  w
> >> www      httpd      97042   15 /var      70919 -rw-------       0  w
> >> www      httpd      97042   16 /var      70919 -rw-------       0  w
> >> www      httpd      26059    9 /var      74653 -rw-------  176907484  w
> >> www      httpd      26059   12 /var      71575 -rw-------  1345623  w
> >>
> >> So I have an Inumber, lets search for that.
> >>
> >> # find / -inum 74653
> >> /usr/ports/net/pptpclient/files
> >>
> >> This confuses me! That is on a different slice.
> >
> > Then that is not the inode you are looking for.  Use "find -x /var ..."
> to
>
> doesnt return anything.
>
> > limit the search to just the /var mountpoint.  Your problem is probably
> > due
> > to a bad logfile rotator that isn't signalling apache to close&reopen the
> > logs, so it keeps logging to a file you have deleted.  If you're using
> > newsyslog, make sure you have listed your apache pidfile on the line
> > correspoinding to any apache logs so it knows which process to signal.
> > See
> > the newsyslog.conf manpage for more details.
>
> Added /var/run/httpd.pid to newsyslog.conf and restarted apache.
>
> I am also using cronolog.
>
> from httpd.conf:
> CustomLog "| /usr/local/sbin/cronolog
> /var/log/apache2/%Y/%m/%d/access.log" combined
>
> Thanks Patrick
>
> >
> > --
> >       Dan Nelson
> >       dnelson at allantgroup.com
> >
>
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "
> freebsd-questions-unsubscribe at freebsd.org"
>

Just a thought . . . perhaps your situation is similar.

I had an issue recently, where /var was maxing out quickly, even after empty
all of the logs. It ended up that I was logging too much prior to log
rotation. I had recently set-up an ftp server and the rsync of the binary I
was mirrorring slammed /var.

So, I limited what my firewall logged. Instead of *log all* I would just
*log*.


-- 
www.nealhogan.net