could you please open the message file and see what message they are? I hope it will help you to do RCA.

Hi joerge,

i tried ur suggestion in little different way- "du -akdh /var | sort -nr > /tmp/var.out". It works well. Can you tell me also can I see when file has last modified by "du -akdh /var | sort -nr" Is it possible somehow to accomodate 'ls -lhtr' with command du -akdh /var | sort -nr | grep "M ". ??

Hi ThePurple

The fact that your messages.x files are so massive tells me you are logging shedloads of stuff in there.

I suggest you make copies of the messages.0 - messages.4 files to an alternative location and then do a # cat /dev/null > messages.0 etc to empty them. This will save you a few hundred MB and give you some breathing space. The next step would be to change your log rotation to rotate your messages files when they get to 10MB or something. Afterwards you should have a look at your /etc/syslog.conf file and amend it to log more efficiently.

You can use this command :

#for file in /tmp/var.out; do ls -lrt $file; done --> it will show you the timestamp.

If the file /tmp/var.out contain only file name, then use

#for file in /tmp/var.out; do find / -t f -name $file -print; done

Hi, you might be can check the /var/adm/sa. did you turn on the sa monitoring.. Just a piece of info.

Regards
Dunstan