Hi,

I am having a Solaris 5.9 server in which an audit trail script is running every day.It is doing nothing but taking the backup of three files given below

-rw-r--r-- 1 root root 1807 May 18 01:30 login_server1_17May2008
-rw-r--r-- 1 root root 0 May 18 01:30 msgs_server1_17May2008
-rw-r--r-- 1 root root 7168 May 18 01:30 history_server1_17May2008.tar

In which msgs_ file size is zero.I cleared wtmpx file and checked but it is not working .
I type dmesg also its showing an error at last line something like

May 15 14:51:19 server1 genunix: [ID 603404 kern.notice] NOTICE: core_log: cub7
5[27241] no space left on device, core truncated: /var/core/core_server1_cub75_ 207_103_1210843251_27241


What else i can do to solve this pbm??

check the /var FS space

Thanks

Please disable audit service within /var/audit directory.

It would probably hog up all of /var if it isn't disabled intime. Check with your team members who activated audit service on that box and why?

Cheers

first of all, remove your core file or move it to some other location. As mentioned, check with your team. df -k and see the % used for file system. If its more than 80%,you need to housekeep. cd /var ;du -sk * |sort -rn to check the culprits and get rid of them. Use this for other partitions as well

'incredible' is right! You need to check the largest files... if they are core dumps or log files (thats what populat /var most of the times), just compress the older ones.

df -h (use -k for Solaris 8 and below) will give you the consumed capacity of your file systems. Your company must be keeping some sort of threshold levels to page/call the on call person to address the issue. We are using 80% for major alerts and 90% for critical alerts!

If it is some other file system than /var and the owner of the culprit files is not root, contact your help desk to contact the file owner to address the issue.

Cheers!