Solaris

Guys

I have solaris 9 and / root is 100% and there is nothing increased the space every thing normal , I think the problem related to audit

How can I stop or shutdown audit service and start it again ?

Pls advice in the reason of this increasing and is it related to audit service ? .

No one can accurately know if the issue is related to an audit service based on (the lack of) information in your post.

Why not search the filesystem yourself and see where the big files are (and what they are)?

I have searched before I submitted , but when I deleted some files is not updated on the server !

I had faced like this issue before once I rebooted the server space has reduced

but I do not like to reboot !

Then simply restart the process(es) still holding the files you thought you delete but actually unlink.

If you have the open deleted files in a /lost+found dir, you can fuser to see who has them open. You should fuser before delete to see if it will immediately delete.

You are confusing things. The lost+found directory is designed to contain files that have been disconnected from the file system after some operating system dysfunction like a power failure. By convention, they are relocated by fsck under the lost+found directory in their file system root. This is unrelated with unlinked files which are no more on the file system but still use disk space. The latter can be easily detected by looking for regular files with 0 links under /proc/<pid>/fd/*.