LinuxQuestions.org - /var not unmounting when system is shutting down i am using centos5.8

First always check system log files for clues. If there aren't any then check the logs which services did shut down properly. If no anomalies are shown and the console doesn't show any either then if the system is local to you, or if you can access it Out of Band, then run

Code:

telinit 1

to bring it to runlevel 1. While not similar to the shutdown or reboot runlevels it should see most services stopped and chances are the one keeping files open in other runlevels will reveal itself here as well. Then run

Code:

lsof -Pwln +D/var

to find it. Alternatively, or if you aren't able to switch to runlevel 1, then you could stop each service manually, check if it did stop properly and if it didn't the list open files for that service. Example:

Code:

pgrep httpd|while read _PID; do lsof -Pwlnp $_PID -a +D/var; done