Alright, here is a question of my own.

I'm the NetAdmin for an Engineering firm. We use CUPS for printing, and samba for roaming profile connections.

After a few days, our /var directory becomes bloated. /var has it's own partition, which is just under 1G, but it is sometimes incorrectly reported as only having a few megs left when there is 900M free.

When /var is filled, our printing services die, as there is no temp space left for spooling.

Doing a du -ch recursively on the /var dir correctly reports a usage of ~90M.

I have a feeling that it's a samba issue, that there is some temp file being held open, and not being reported.

A server reboot / Samba shutdown will deflate /var, but this is not a great solution.

Anyone seen this?

/var is a psuedo filesystem in which logs and files are always being written there. Most likely what your seeing is someone going in and deleting a file while a process is still trying to write to that file.. so if the file is not physically there but a process is trying to write to it, well, it will hold onto that chunk of space still only to release it once the process is dead.

As I thought...

A shot in the dark -- Is there a way to tell which process is holding the space hostage?

I have a feeling that restarting smbd is the only option...