Cleaning /var files system
My /var files system is at 98%. I searched for any file that is bigger 15M. Please let me know what file I can delete from the system. Please advise!
[root@usbalp-nis01 var]# df -h |grep /var
/dev/mapper/vg00-var 4.0G 3.9G 102M 98% /var
[root@usbalp-nis01 var]#
[root@usbalp-nis01 var]# find . -size +10M
./lib/rpm/Packages
./lib/samba/locking.tdb
./lib/mlocate/mlocate.db
./lib/mysql/ibdata1
./lib/mysql/ib_logfile1
./lib/mysql/ib_logfile0
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/primary.xml
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/other.xml
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/primary.xml.sqlite
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/other.xml.sqlite
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-31.5.0-2.el7_0.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/glibc-common-2.17-55.el7_0.5.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.75-2.5.4.2.el7_0.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-123.20.1.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20140804-0.1.git6bce2b0.el7_0.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/mesa-dri-drivers-9.2.5-6.20131218.el7_0.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/glibc-common-2.17-78.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/libkkc-data-0.3.1-5.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20140911-0.1.git365e80c.el7.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/mesa-dri-drivers-10.2.7-5.20140910.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-31.5.3-3.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.75-2.5.4.7.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.1.2.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-38.0-3.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.79-2.5.5.1.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.4.2.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kdelibs-4.10.5-6.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-38.4.0-1.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/mesa-dri-drivers-10.2.7-5.20140910.el7_1.1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.1.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.20.1.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/gnome-getting-started-docs-3.14.1.0.2-1.el7.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/gnome-backgrounds-3.14.1-1.el7.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-327.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kdelibs-4.14.8-4.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20150904-43.git6ebf5d5.el7.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/gnome-user-docs-3.14.2-1.el7.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/primary.xml.gz
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/other.xml.gz
./cache/yum/x86_64/7Server/rhel-x86_64-server-optional-7/gen/primary.xml
./cache/yum/x86_64/7Server/rhel-x86_64-server-optional-7/gen/primary.xml.sqlite
./cache/yum/x86_64/7Server/mysql56-community/packages/mysql-community-server-5.6.27-2.el7.x86_64.rpm
./cache/yum/x86_64/7Server/mysql56-community/packages/mysql-community-client-5.6.27-2.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll lib/rpm/Packages
-rw-r--r--. 1 root root 84340736 Sep 25 15:37 lib/rpm/Packages
[root@usbalp-nis01 var]# ll lib/samba/locking.tdb
-rw-r--r--. 1 root root 21700608 Nov 20 08:09 lib/samba/locking.tdb
[root@usbalp-nis01 var]# ll lib/mlocate/mlocate.db
-rw-r-----. 1 root slocate 510992794 Nov 19 03:21 lib/mlocate/mlocate.db
[root@usbalp-nis01 var]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg00-root 4.4G 3.9G 611M 87% /
devtmpfs 911M 0 911M 0% /dev
tmpfs 921M 88K 921M 1% /dev/shm
tmpfs 921M 90M 831M 10% /run
tmpfs 921M 0 921M 0% /sys/fs/cgroup
/dev/mapper/vg01-home 3.8T 3.5T 345G 92% /home
/dev/mapper/vg00-usr_local 125M 6.7M 119M 6% /usr/local
/dev/mapper/vg00-opt 125M 6.6M 119M 6% /opt
/dev/mapper/vg00-tmp 509M 27M 482M 6% /tmp
/dev/mapper/vg00-var 4.0G 3.9G 104M 98% /var
/dev/sda1 253M 194M 59M 77% /boot
/dev/mapper/vg01-apps32 15G 7.7G 6.3G 56% /home/apps32
[root@usbalp-nis01 var]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg00-root 4.4G 3.9G 611M 87% /
devtmpfs 911M 0 911M 0% /dev
tmpfs 921M 88K 921M 1% /dev/shm
tmpfs 921M 90M 831M 10% /run
tmpfs 921M 0 921M 0% /sys/fs/cgroup
/dev/mapper/vg01-home 3.8T 3.5T 345G 92% /home
/dev/mapper/vg00-usr_local 125M 6.7M 119M 6% /usr/local
/dev/mapper/vg00-opt 125M 6.6M 119M 6% /opt
/dev/mapper/vg00-tmp 509M 27M 482M 6% /tmp
/dev/mapper/vg00-var 4.0G 3.9G 104M 98% /var
/dev/sda1 253M 194M 59M 77% /boot
/dev/mapper/vg01-apps32 15G 7.7G 6.3G 56% /home/apps32
[root@usbalp-nis01 var]# find . -size +15M
./lib/rpm/Packages
./lib/samba/locking.tdb
./lib/mlocate/mlocate.db
./lib/mysql/ib_logfile1
./lib/mysql/ib_logfile0
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/primary.xml
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/other.xml
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/primary.xml.sqlite
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/other.xml.sqlite
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-31.5.0-2.el7_0.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.75-2.5.4.2.el7_0.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-123.20.1.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20140804-0.1.git6bce2b0.el7_0.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20140911-0.1.git365e80c.el7.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-31.5.3-3.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.75-2.5.4.7.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.1.2.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-38.0-3.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.79-2.5.5.1.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.4.2.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-38.4.0-1.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.1.el7_1.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.20.1.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/gnome-backgrounds-3.14.1-1.el7.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-327.el7.x86_64.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20150904-43.git6ebf5d5.el7.noarch.rpm
./cache/yum/x86_64/7Server/rhel-x86_64-server-7/other.xml.gz
./cache/yum/x86_64/7Server/rhel-x86_64-server-optional-7/gen/primary.xml
./cache/yum/x86_64/7Server/rhel-x86_64-server-optional-7/gen/primary.xml.sqlite
./cache/yum/x86_64/7Server/mysql56-community/packages/mysql-community-server-5.6.27-2.el7.x86_64.rpm
./cache/yum/x86_64/7Server/mysql56-community/packages/mysql-community-client-5.6.27-2.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll lib/rpm/Packages
-rw-r--r--. 1 root root 84340736 Sep 25 15:37 lib/rpm/Packages
[root@usbalp-nis01 var]# ll lib/samba/locking.tdb
-rw-r--r--. 1 root root 21700608 Nov 20 08:15 lib/samba/locking.tdb
[root@usbalp-nis01 var]# ll lib/mlocate/mlocate.db
-rw-r-----. 1 root slocate 510992794 Nov 19 03:21 lib/mlocate/mlocate.db
[root@usbalp-nis01 var]# ll lib/mysql/ib_logfile1
-rw-rw----. 1 mysql mysql 50331648 Aug 19 16:57 lib/mysql/ib_logfile1
[root@usbalp-nis01 var]# ll lib/mysql/ib_logfile0
-rw-rw----. 1 mysql mysql 50331648 Aug 19 16:57 lib/mysql/ib_logfile0
[root@usbalp-nis01 var]# expr 50331648 / 1024
49152
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/primary.xml
-rw-r--r--. 1 root root 74771864 Nov 19 03:52 cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/primary.xml
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/other.xml
-rw-r--r--. 1 root root 380546619 Nov 19 03:52 cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/other.xml
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/primary.xml.sqlite
-rw-r--r--. 1 root root 92409856 Nov 19 06:02 cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/primary.xml.sqlite
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/other.xml.sqlite
-rw-r--r--. 1 root root 388567040 Nov 19 17:35 cache/yum/x86_64/7Server/rhel-x86_64-server-7/gen/other.xml.sqlite
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-31.5.0-2.el7_0.x86_64.rpm
-rw-r--r--. 1 root root 63725392 Feb 24 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-31.5.0-2.el7_0.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.75-2.5.4.2.el7_0.x86_64.rpm
-rw-r--r--. 1 root root 26274616 Jan 20 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.75-2.5.4.2.el7_0.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-123.20.1.el7.x86_64.rpm
-rw-r--r--. 1 root root 30301292 Jan 28 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-123.20.1.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20140804-0.1.git6bce2b0.el7_0.noarch.rpm
-rw-r--r--. 1 root root 21914840 Sep 22 2014 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20140804-0.1.git6bce2b0.el7_0.noarch.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.el7.x86_64.rpm
-rw-r--r--. 1 root root 32385364 Feb 23 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20140911-0.1.git365e80c.el7.noarch.rpm
-rw-r--r--. 1 root root 17837664 Feb 23 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20140911-0.1.git365e80c.el7.noarch.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-31.5.3-3.el7_1.x86_64.rpm
-rw-r--r--. 1 root root 63730252 Mar 24 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-31.5.3-3.el7_1.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.75-2.5.4.7.el7_1.x86_64.rpm
-rw-r--r--. 1 root root 26289636 Mar 26 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.75-2.5.4.7.el7_1.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.1.2.el7.x86_64.rpm
-rw-r--r--. 1 root root 32388604 Mar 26 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.1.2.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-38.0-3.el7_1.x86_64.rpm
-rw-r--r--. 1 root root 74980552 May 12 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-38.0-3.el7_1.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.79-2.5.5.1.el7_1.x86_64.rpm
-rw-r--r--. 1 root root 26304868 Apr 14 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.79-2.5.5.1.el7_1.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.4.2.el7.x86_64.rpm
-rw-r--r--. 1 root root 32412080 May 12 2015 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.4.2.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-38.4.0-1.el7_1.x86_64.rpm
-rw-r--r--. 1 root root 75005860 Nov 4 00:13 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/firefox-38.4.0-1.el7_1.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.1.el7_1.x86_64.rpm
-rw-r--r--. 1 root root 26483576 Oct 21 11:41 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.1.el7_1.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.20.1.el7.x86_64.rpm
-rw-r--r--. 1 root root 32430412 Nov 3 08:26 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-229.20.1.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/gnome-backgrounds-3.14.1-1.el7.noarch.rpm
-rw-r--r--. 1 root root 16367884 Sep 29 08:06 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/gnome-backgrounds-3.14.1-1.el7.noarch.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-327.el7.x86_64.rpm
-rw-r--r--. 1 root root 34629920 Nov 1 10:32 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/kernel-3.10.0-327.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20150904-43.git6ebf5d5.el7.noarch.rpm
-rw-r--r--. 1 root root 25226884 Oct 13 00:03 cache/yum/x86_64/7Server/rhel-x86_64-server-7/packages/linux-firmware-20150904-43.git6ebf5d5.el7.noarch.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-7/other.xml.gz
-rw-r--r--. 1 root root 94979011 Nov 19 03:52 cache/yum/x86_64/7Server/rhel-x86_64-server-7/other.xml.gz
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-optional-7/gen/primary.xml
-rw-r--r--. 1 root root 18480842 Nov 19 03:52 cache/yum/x86_64/7Server/rhel-x86_64-server-optional-7/gen/primary.xml
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/rhel-x86_64-server-optional-7/gen/primary.xml.sqlite
-rw-r--r--. 1 root root 16640000 Nov 19 06:02 cache/yum/x86_64/7Server/rhel-x86_64-server-optional-7/gen/primary.xml.sqlite
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/mysql56-community/packages/mysql-community-server-5.6.27-2.el7.x86_64.rpm
-rw-r--r--. 1 root root 60492152 Sep 30 01:49 cache/yum/x86_64/7Server/mysql56-community/packages/mysql-community-server-5.6.27-2.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll cache/yum/x86_64/7Server/mysql56-community/packages/mysql-community-client-5.6.27-2.el7.x86_64.rpm
-rw-r--r--. 1 root root 20076444 Sep 30 01:49 cache/yum/x86_64/7Server/mysql56-community/packages/mysql-community-client-5.6.27-2.el7.x86_64.rpm
[root@usbalp-nis01 var]# ll lib/samba/locking.tdb
-rw-r--r--. 1 root root 21700608 Nov 20 08:45 lib/samba/locking.tdb
[root@usbalp-nis01 var]# uname -a
Linux usbalp-nis01.corp.cubic.cub 3.10.0-229.4.2.el7.x86_64 #1 SMP Fri Apr 24 15:26:38 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux
[root@usbalp-nis01 var]#
Responses
Hi Kevin,
You'll need enough room under /var/cache so yum can download rpms needed for any given update without consternation.
That being said, the things that contribute to /var filling up are more than just files over 10mb.
I've seen filesystems that exist on Heavily Audited(TM) systems that rack up hundreds of thousands of files, if not mitigated.
I've also seen (ab)uses of Tomcat where people make backup copies of "war" files without consideration of the footprint of size needed for /var to breathe.
I've also seen (ab)uses of /var/spool/clientmqueue where system mail is queued, and if no sendmail/postfix is set to send these, they will accumulate until time ends, or your hard drive fills up, whichever comes first.
I've also seen (ab)uses of errant crons that fail to have the following after a cron entry
## bad example, no truncating to /dev/null
0,30 * * * * /path/to/some/script.bash
## an entry that will avert mail being generated for standard output/errors (you can put mail statements in your script instead)
0,30 * * * * /path/to/some/script.bash > /dev/null 2>&1
## your mileage may vary, and there are likely other factors
I've also seen where logwatch (probably useless for a server) is running on a server. some may like it, some may not, I have no need for it, and disable it so worthless (to me) email doesn't clog /var/spool/clientmqueue, and instead, I have Nagios or Zenoss provide health status etc.
Just today (and in the past too), I've seen the results of people who create atypical non-standard logs in /var/log but with no corresponding sane /etc/logrotate.d/FILE entry to perform actual log rotation, and then discover their new shiny log file has grown to 4.8GB because no logrotate directive exists because those people put logging in without any consideration for logrotate.
The above is not the sum of possibilities for what contributes to /var/ filling up. That is just a start.
I often will start with...
cd /var/
du -sk ./* | sort -nr > du-sk-for-20151120.txt
head du-sk-for-20151120.txt
Then pick on the "life of the party" (dig into subdirectories and repeat this process) as shown in the text file above and then narrow down the culprit(s) in terms of files (quantity, size, or both) and take appropriate action.
If some entity within your organization requires all tomcat logs (or some other log) to be kept forever (or a year or so), and it's highly verbose, you could use remote logging using rsyslog or perl scripts that move off tomcat and other logs as a couple of ideas to take care of that.
I'd make sure that "compress" is used whereever possible for /var/log/nameof.log within any /etc/logrotate.d/NAMEOFFILE within reason.
This discussion you started basically shows you're having a problem with /var/ filling up and the output of a find command.
I'd recommend you look into each subdirectory under /var/ to determine what is the largest directories contributing to the 'party' and then take sane action.
Hope this helps...
Oh, I partition off things in /var and make additional partitions under /var such as
/var/log
/var/log/audit
/var/lib
/var/tmp
yes, mine is overkill, but I have the disk space, and I would rather have overkill and segregate off things that attempt to fill up /var/ as a whole. I have over time found what contributes highly under /var and adjust my kickstarts accordingly. Also, see this previous discussion from a while ago on the pros/cons for making sub-partitions under /var/
If you are bound to comply with STIG requirements, you will find some of this identified within the STIG.
Hey Kevin - it's worth mentioning that var can frequently have orphaned files (due to user/operator error). Typically the sysadmin gets a call about a full filesystem, which they identify as an application log (say catalina.out, for example) which then is handed off to the application team to clean up. The app-owner then runs rm /var/log/tomcat6/catalina.out - not realizing that the application had the file open...
# lsof | grep deleted
It is normal to see (deleted) a few times, but if you see some in /var that are sizeable, I would chase them down. Usually the "fix" is to simply restart the application that had the old file locked. Also - depending on your usage and/or standards you could consider disabling updatedb (/var/lib/mlocate/mlocate.db)
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
