/var filesystem filling up and discrepancy between disk usage (du) and disk free (df) space
Article ID: CTX206849
Updated On:
Description
- /var filesystem running low on disk space:
df -akin
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/md0 327M 314M 6M 98% 11k 32k 26% /
devfs 1.0k 1.0k 0B 100% 0 0 100% /dev
procfs 4.0k 4.0k 0B 100% 1 0 100% /proc
/dev/ad0s1a 1.4G 885M 446M 66% 1.1k 210k 0% /flash
/dev/ad0s1e 13G 12G 509M 96% 12k 1.8M 1% /var
/dev/ad1s1a 20G 26M 18G 0% 5 2.8M 0% /var/crash
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/md0 327M 314M 6M 98% 11k 32k 26% /
devfs 1.0k 1.0k 0B 100% 0 0 100% /dev
procfs 4.0k 4.0k 0B 100% 1 0 100% /proc
/dev/ad0s1a 1.4G 885M 446M 66% 1.1k 210k 0% /flash
/dev/ad0s1e 13G 12G 509M 96% 12k 1.8M 1% /var
/dev/ad1s1a 20G 26M 18G 0% 5 2.8M 0% /var/crash
- Disk usage does not match disk space:
du -d 0 /var
3.9G /var
3.9G /var
Resolution
Determine the user of the disk space using the fstat command (in this case, the issue was the AppFw learning process-aslearn):
fstat
<SNIP>
root aslearn 37000 root / 2 drwxr-xr-x 512 r
root aslearn 37000 wd / 2 drwxr-xr-x 512 r
root aslearn 37000 text / 24677 -rwxr-xr-x 225120 r
root aslearn 37000 0 /dev 8 crw-rw-rw- null rw
root aslearn 37000 1 /dev 8 crw-rw-rw- null rw
root aslearn 37000 2 /dev 8 crw-rw-rw- null rw
root aslearn 37000 3 /dev 8 crw-rw-rw- null w
root aslearn 37000 4* local dgram ffffff0036a811e0 <-> ffffff0017e31a50
root aslearn 37000 5 /var 353415 -rw-r--r-- 8313970176 rw
root aslearn 37000 6* internet stream tcp ffffff006bf65b10
root aslearn 37000 7 / 24678 -r--r--r-- 448 r
root aslearn 37000 8* local stream ffffff007000f5a0 <-> ffffff0017e5f5a0
root aslearn 37000 9 /var 353291 -rw-r--r-- 3072 rw
root aslearn 37000 10* internet stream tcp ffffff00365e8b10
<SNIP>
<SNIP>
root aslearn 37000 root / 2 drwxr-xr-x 512 r
root aslearn 37000 wd / 2 drwxr-xr-x 512 r
root aslearn 37000 text / 24677 -rwxr-xr-x 225120 r
root aslearn 37000 0 /dev 8 crw-rw-rw- null rw
root aslearn 37000 1 /dev 8 crw-rw-rw- null rw
root aslearn 37000 2 /dev 8 crw-rw-rw- null rw
root aslearn 37000 3 /dev 8 crw-rw-rw- null w
root aslearn 37000 4* local dgram ffffff0036a811e0 <-> ffffff0017e31a50
root aslearn 37000 5 /var 353415 -rw-r--r-- 8313970176 rw
root aslearn 37000 6* internet stream tcp ffffff006bf65b10
root aslearn 37000 7 / 24678 -r--r--r-- 448 r
root aslearn 37000 8* local stream ffffff007000f5a0 <-> ffffff0017e5f5a0
root aslearn 37000 9 /var 353291 -rw-r--r-- 3072 rw
root aslearn 37000 10* internet stream tcp ffffff00365e8b10
<SNIP>
Problem Cause
Application Firewall had learning mode enabled while in production. Learning mode is recommended to only be used during initial configuration of the feature and should NOT be enabled for production.Issue/Introduction
/var filesystem running low on disk space:
Was this article helpful?
Yes
No
Powered by
