Var out of space, or is it?

signalz

I'm having a problem with /var supposedly running out of space. It's configured for 60MB, on the dashboard it shows 108% CPU usage, but du -mhs /var says it's only using 30MB. The DNS service crashes constantly and watchdog can't always restart it. I stopped snort as a temporary fix. I've had it set up for a while so I don't think that's causing the problem. My most recent changes on this box were a change to an alias used by snort's passlist and adding services to watchdog to monitor. Why is /var out of space but really not?

msf2000

I'd try disabling RAM disk and see if you're first running out of memory. If you can verify that there's plenty of ram, just increase disk size. I wouldn't recommend anything under 128MB. There could be an update process or something using /var as temporary space.

bmeeks

@signalz said in Var out of space, or is it?:

I'm having a problem with /var supposedly running out of space. It's configured for 60MB, on the dashboard it shows 108% CPU usage, but du -mhs /var says it's only using 30MB. The DNS service crashes constantly and watchdog can't always restart it. I stopped snort as a temporary fix. I've had it set up for a while so I don't think that's causing the problem. My most recent changes on this box were a change to an alias used by snort's passlist and adding services to watchdog to monitor. Why is /var out of space but really not?

Snort can use quite a bit of space in /var for its logs, especially on a busy network and if you have lots of Snort rules enabled and firing.

What kind of hardware are you running on? Why is /var so restricted? That is where all of the logging happens.