@signalz said in Var out of space, or is it?:
I'm having a problem with /var supposedly running out of space. It's configured for 60MB, on the dashboard it shows 108% CPU usage, but du -mhs /var says it's only using 30MB. The DNS service crashes constantly and watchdog can't always restart it. I stopped snort as a temporary fix. I've had it set up for a while so I don't think that's causing the problem. My most recent changes on this box were a change to an alias used by snort's passlist and adding services to watchdog to monitor. Why is /var out of space but really not?
Snort can use quite a bit of space in /var for its logs, especially on a busy network and if you have lots of Snort rules enabled and firing.
What kind of hardware are you running on? Why is /var so restricted? That is where all of the logging happens.