System Management Guide: Operating System and Devices

Fixing Disk Overflows

A disk overflow occurs when too many files fill up the allotted space. This can be caused by a runaway process that creates many unnecessary files. You can use the following procedures to correct the problem:

To identify the processes that may be causing the overflow, go to Identifying Problem Processes .
To terminate the process, go to Terminating the Process .
To reclaim file space without terminating the process, go to Reclaiming File Space without Terminating the Process .
To fix an overflow in the /usr directory, go to Fixing a /usr Overflow .
To fix an overflow in a user file system, go to Fixing a User File System Overflow .

Prerequisites

You must have root user authority to remove processes other than your own.

Identifying Problem Processes

To check the process status and identify processes that might be causing the problem, type:
```
ps -ef | pg 
```
The ps command shows the process status. The -e flag writes information about all processes (except kernel processes), and the -f flag generates a full listing of processes including what the command name and parameters were when the process was created. The pg command limits output to a single page, so you are not confronted with reams of information scrolling quickly off the screen.
Check for system or user processes that are using excessive amounts of a system resource, such as CPU time. System processes such as sendmail, routed, and lpd seem to be the system processes most prone to becoming runaways.
To check for user processes that use more CPU than expected, type:
```
ps -u
```

Terminating the Process

To suspend or terminate the process causing the problem, type:
```
kill -9 1182
```
In this example, the kill command terminates the execution of the process numbered 1182.
Remove the files the process has been making, by typing:
```
rm file1 file2 file3
```

Reclaiming File Space without Terminating the Process

When an active file is removed from the file system, the blocks allocated to the file remain allocated until the last open reference is removed, either as a result of the process closing the file or because of the termination of the processes that have the file open. If a runaway process is writing to a file and the file is removed, the blocks allocated to the file are not freed until the process terminates.

To reclaim the blocks allocated to the active file without terminating the process, redirect the output of another command to the file. The data redirection truncates the file and reclaims the blocks of memory. For example:

$ ls -l
total 1248
-rwxrwxr-x      1 web   staff   1274770 Jul 20 11:19 datafile
$ date > datafile
$ ls -l
total 4
-rwxrwxr-x      1 web   staff        29 Jul 20 11:20 datafile

The output of the date command replaced the previous contents of the datafile file. The blocks reported for the truncated file reflect the size difference from 1248> to 4. If the runaway process continues to append information to this newly truncated file, the next ls command produces the following results:

$ ls -l
total 8
-rxrwxr-x       1 web   staff   1278866 Jul 20 11:21 datefile

The size of the datafile file reflects the append done by the runaway process, but the number of blocks allocated is small. The datafile file now has a hole in it. File holes are regions of the file that do not have disk blocks allocated to them.

Fixing a /usr Overflow

Use this procedure to fix an overflowing file system in the /usr directory.

Remove printer log files by typing:

rm -f /usr/adm/lp-log
rm -f /usr/adm/lw-log

Remove uucp log files by typing:

rm -f /usr/spool/uucp/LOGFILE
rm -f /usr/spool/uucp/SYSLOG
rm -f /usr/spool/uucp/ERRLOG

Remove unnecessary files in /tmp and /usr/tmp. It is a good practice to do this weekly. For example, type:
```
find /tmp -type f -atime +7 -exec rm -f {} \;
find /usr/tmp -type f -atime +7 -exec rm -f {} \;
```
Delete lines in /var/adm/wtmp if you do not need the files for accounting. Because /var/adm/wtmp contains records of date changes that include old and new dates, you can delete the old records. However, since wtmp is a binary file, you must first convert it to ASCII. To edit /var/adm/wtmp:
1. Convert the wtmp file from a binary file to an ASCII file called wtmp.new by typing:
```
/usr/sbin/acct/fwtmp < /var/adm/wtmp >
wtmp.new
```
2. Edit the wtmp.new file to shorten it by typing:
```
vi wtmp.new
```
3. Convert the wtmp.new file from ASCII back to the wtmp binary format by typing:
```
/usr/sbin/acct/fwtmp -ic < wtmp.new >
/var/adm/wtmp
```

Fixing a User File System Overflow

Use this procedure to fix an overflowing user file system.

Remove old backup files and core files. The following example removes all *.bak, .*.bak, a.out, core, *, or ed.hup files.

find / \( -name "*.bak" -o -name core -o -name a.out
-o \
        -name "...*" -o -name ".*.bak" -o -name ed.hup \) \
        -atime +1 -mtime +1 -type f -print | xargs -e rm -f

To prevent files from regularly overflowing the disk, run the skulker command as part of the cron process and remove files that are unnecessary or temporary.
The skulker command purges files in /tmp directory, files older than a specified age, a.out files, core files, and ed.hup files. It is run daily as part of an accounting procedure run by the cron command during off-peak periods (assuming you have turned on accounting).
The cron daemon runs shell commands at specified dates and times. Regularly scheduled commands such as skulker can be specified according to instructions contained in the crontab files. Submit crontab files with the crontab command. To edit a crontab file, you must have root user authority.
For more information about how to create a cron process or edit the crontab file, refer to Setting Up an Accounting System.