I had a problem where log files grew very big on /var. My usage was at 100% per 'df -h'. I removed all the big log files, but it's still showing as 100% usage. If I run 'du -sh /var' , it's only 600MB now, but it's showing as 6.5GB on the output of the 'df -h' command. It's mounted as it's own partition.

I need it to realize only 600MB are being used without actually remounting the /var partition, since people are using the server. Until I do this, postfix SMTP will not receive emails, saying there's not space left on device.

Any help would be appreciated.

Well, if you've deleted a file while it's still in use you've created
a harder to diagnose problem ... the file (and it's allocated inodes)
will remain in use until you shut down the service/process that had
created it.

In other words ... remember what you killed, which process owned it,
and then HUP that process.


Cheers,
Tink

Tinkster:
Thanks for the tip. The log files I deleted were from several days ago, and I made sure they were not being accessed.

The solution was, as I suspected, to unmount/remount the /var partition. I just warned my users, and rebooted. Now the output of 'df -h' shows the correct usage.

It still bugs me that it took a remount to update the output.

A reboot shouldn't have been necessary if the umount actually worked.
If it didn't it indicates that some process was still holding on to
some files.


Cheers,
Tink

Next time "lsof|grep '/var/path/log_file'" might help diagnose which program is responsible

"lsof|grep '/var/path/log_file'"
Use "lsof +D /var/log" and get one command to use elsewhere for free!!!
That's amazing, Mike.

have you got logrotate running?
you can add your own logfiles if you need to, in /etc/logrotate.conf

tobyl