12/08/95, 4FAX# 1609 Managing File System Space SPECIAL NOTICES Information in this document is correct to the best of our knowledge at the time of this writing. Please send feedback by fax to "AIXServ Information" at (512) 823-4009. Please use this information with care. IBM will not be responsible for damages of any kind resulting from its use. The use of this information is the sole responsibility of the customer and depends on the customer's ability to eval- uate and integrate this information into the customer's operational environment. ABOUT THIS DOCUMENT This document addresses what files may need monitoring on a system to prevent excess space utilization and what to look for if you unexpectedly lose space in a filesystem. This document is applicable to AIX versions 3.2 and 4.1. IF ROOT (/) IS FULL o Check the /etc/security/failedlogin file. Use the following command to read the contents of the file. last -f /etc/security/failedlogin Tty's respawning too rapidly will create failed login entries. To clear the file after reading or saving the output use: cp /dev/null /etc/security/failedlogin o Check the /dev directory If a device name is mis-typed such as rmto instead of rmt0 a file will be created in /dev called rmto. The command will normally proceed until the entire root filesystem is filled before failing (/dev is part of the / filesystem). Look for entries that are not devices (do not have a major or minor number). cd /dev ls -l |pg Where you would normally see a file size on a ordinary file, a device file will have two numbers separated by a comma, such as: crw-rw-rw- 1 root system 12, 0 Oct 25 10:19 rmt0 µ µ If instead you see something like: Managing File System Space 1 12/08/95, 4FAX# 1609 crw-rw-rw- 1 root system 9375473 Oct 25 10:19 rmto µ This is a file and should be removed. NOTE: the /dev directory has some valid filenames, look for a file that has a large size (larger than 500 bytes). NOTE: If you are running system auditing, the /audit directory (default) may rapidly fill up and require attention. o Check for very large files You can locate large files with the find command. To find all files in the root (/) directory larger than 1MB, use: find / -xdev -size +2048 -ls |sort -r +6 This will find all files greater than 1 MB and sort them in reverse order with the largest files first. NOTE: When checking the root dir, entries from the /dev directory that have major and minor numbers instead of file sizes will be interspersed with "real" files and can be ignored. Use InfoExplorer for other useful find command flags that may be helpful like the -newer flag. IF /VAR IS FULL o In /var/tmp, check for old leftover files. /var/adm/wtmp is a file that is used to log all logins, rlogins and tn sessions. If it is not monitored it will grow forever unless you are running system accounting (clears it out nightly). You can either clear it out or edit the file to remove old and unwanted information. To clear /var/adm/wtmp: cp /dev/null /var/adm/wtmp To edit the file and remove unwanted entries: /usr/sbin/acct/fwtmp < /var/adm/wtmp >/tmp/out Edit the /tmp/out file to remove unwanted entries then put the edited version back in wtmp. /usr/sbin/acct/fwtmp -ic < /tmp/out > /var/adm/wtmp o In /var/adm/ras directory clear the error log. This directory contain the error log, errlog. It is never cleared unless you manually clear it. DO NOT cp /dev/null to it or you will disable the error logging Managing File System Space 2 12/08/95, 4FAX# 1609 functions of the system. A zero (0) length errlog file must be replaced from a backup tape. You can clear the log or remove all entries up to a certain number of days using the errclear command: - To clear the error log: errclear 0 - To clear the error log but leave the past week's error entries: errclear 7 NOTE There is a file in this directory which may be large due to a trace being run. The trcfile file can be removed: rm /var/adm/ras/trcfile o The /var/spool directory contains the queueing subsystem files. Clear the queueing subsystem: 1. stopsrc -s qdaemon 2. rm /var/spool/lpd/qdir/* 3. rm /var/spool/lpd/stat/* 4. rm /var/spool/qdaemon/* 5. startsrc -s qdaemon o The /var/adm/acct directory contains accounting records. If accounting is running, this directory may contain several large files. Information on how to manage these files can be found in System Management Guide chapter 14 (SC23-2457-01). o The /var/preserve directory contains old terminated vi sessions. Delete these. While old vi sessions can be used to recover files that were abnormally terminated, you can delete these files as you please. However, you may want to keep some of the newer ones in case users want to recover files. To recover a file, use: vi -r filename or vi -r This will list all available files that are recoverable. o Modify /var/adm/sulog. This file tracks the number of attempted su's and whether they are successful or not. This is a flat file and can be viewed and modified with vi. If it is removed it will be recreated by the next attempted su. o Modify /var/tmp/snmpd.log. This is used by the snmpd daemon as a log. If the file is removed it will be recreated by the snmpd daemon. Managing File System Space 3 12/08/95, 4FAX# 1609 NOTE: You can limit the size of this file so that it does not grow indefinitely by editing the /etc/snmpd.conf file under the section for size. This is in bytes. NOTE: You can also use the find command to discover large files in /var like: find /var -xdev -size +2048 -ls| sort -r +6 NOTE: AIX provides a general system cleanup script called skulker located in the /usr/sbin directory. Before attempting to run the skulker command, look at the skulker entry in InfoExplorer and read the script for details to determine what files it will delete and what time frame it will allow files to exist before deletion. skulker may be run as a cron job using the following crontab entry: 0 3 * * * /usr/sbin/skulker Consider limiting the errlog by the running these entries in cron: 0 11 * * * /usr/bin/errclear -d S,O 30 0 12 * * * /usr/bin/errclear -d H 90 OTHER FILESYSTEMS OR GENERAL SEARCH TECHNIQUES Use the find command with the -size flag to attempt to locate large files or if the filesystem just filled up, use the -newer flag to find recently modified files. To produce a file for the newer flag to find against use the touch command like: touch mmddhhmm filename Where: o mm is month o dd is day o hh is hour (24 hour format) o mm is minute The command would be: find /filesystem_name -xdev -newer touched_file -ls Another useful flag for the find command will allow you to locate files changed in the last 24 hours: find /filesystem_name -xdev -mtime 0 -ls Managing File System Space 4 12/08/95, 4FAX# 1609 READER'S COMMENTS Please fax this form to (512) 823-4009, attention "AIXServ Informa- tion". You may also e-mail comments to: elizabet@austin.ibm.com. These comments should include the same customer information requested below. Use this form to tell us what you think about this document. If you have found errors in it, or if you want to express your opinion about it (such as organization, subject matter, appearance) or make sug- gestions for improvement, this is the form to use. If you need technical assistance, contact your local branch office, point of sale, or 1-800-CALL-AIX (for information about support offer- ings). These services may be billable. Faxes on a variety of sub- jects may be ordered free of charge from 1-800-IBM-4FAX. Outside the U.S. call 415-855-4329 using a fax machine phone. When you send comments to IBM, you grant IBM a nonexclusive right to use or distribute your comments in any way it believes appropriate without incurring any obligation to you. NOTE: If you have a problem report or item number, supplying that number may help us determine why a procedure did or did not work in your specific situation. Problem Report or Item #: Branch Office or Customer #: Be sure to print your name and fax number below if you would like a reply: Name: Fax Number: ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ END OF DOCUMENT (out.of.space.cmd, 4FAX# 1609) Managing File System Space 5