I have daily reports sent to /var/www/sarg/ONE-SHOT
However, my /var is out of space.
How can I send these files somewhere else on the server that has space but have the web service get the page from there instead of /var/www?

Hello,

/var is used by various system processes for logging, package managers for keeping their cache and so on. So it's better practice in my opinion to clean up your /var first instead of just redirecting output of one process in particular. You'll be confronted by several other issues shortly if you don't clean up your /var I'm afraid. Delete old logs, clear your package manager cache, enlarge /var if you can.

Kind regards,

Eric

How can I make var bigger though?
Wouldn;t it be better to mount /var on a different drive?
Can I just do this on the server:
mount /dev/sdb1 /var/www/

That shows /var only 44% used ... ?

The details of how to make the file system mounted at /var bigger depend on several things including whether you have any unused space on the /dev/sda HDD. Essentially you change the runlevel to single user mode when almost everything is stopped and /var can be unmounted. Then you enlarge it (if there is space available on /sda adjacent to /the /dev/sda3 partition) or you set up a new bigger file system, copy the old /var files to it and change /etc/fstab so the new file system is mounted at /var.

Whether it is "better" to use another HDD for the /var file system depends on information we don't have and a choice only you can make. Given the relevant information we could point out the pros and cons to help you make that choice.

It is simple to do as you suggest and has the advantage that filling up /var/www would not fill up /var on which so many system facilities write. If you do choose that option, its a good idea to udate /etc/fstab so /var/www is automatically mounted at boot.

now 44% as I deleted the /var/www/sarg folder. It was 100% before and made various service stop.
So, I would have to put /dev/sda2 into single user mode? Hmm can't do that as it is a production server and would stop many things.
Is it not possible to mount on the fly or maybe use a pseudo folder with symlink?
It is just sarg causing the problem with overnight reports. I could, for example, save the reports elsewhere but how would I get the webserver to use that folder instead?

one thing I note, is that /usr and /etc don;t seem to be mounted. Are they under root?

It's the system and not the partition that you would have to put into single user mode. If uptime is so important you might find LVM and dynamically re-sizeable file systems a useful technique.
Yes to both (Linux-speak is directory, not folder) with a caveat that I'm not sure what wil happen to any files that are held open in the old place and to any processes that have directories in the old place as their current directories; a symlink would be safer because it should (TM) only affect new file system activity. If you mount a new file system on /var/www, all directories and files under it will become inaccessible; they will still be there but hidden. If my concerns are valid, restarting the webserver should (again TM) fix it.
Almost certainly; you could look.

I created a symlink on /var/www to point to /usr/local/sbin but now that is filling up the mount of / on my drive.
Really the only drive that has space is /sda2
So, is my only option to mount a folder on /sda2?

I have done this:
[root ~]# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda5 4956284 3908292 792160 84% /
/dev/sda3 4956316 2045956 2654528 44% /var
/dev/sda1 77749 23675 50060 33% /boot
tmpfs 475204 0 475204 0% /dev/shm
/dev/sda2 233345000 42168532 191176468 19% /var/spool/squid
/dev/sda2 233345000 42168532 191176468 19% /usr/local/sbin/sarg


does that mean all files in /usr/local/sbin/sarg now reside on sda2?

So I have a symlink in /var/www to /usr/local/sbin and /usr/local/sbin is now on sda2?

What happened to /dev/sdb1?

Can you paste the output of an ls -l command showing your symlink and paste the contents of /proc/mounts?

don't think I ever had sdb1?

[root sbin]# cd /var/www
[root www]# ls -l
total 52
drwxr-xr-x 2 root root 4096 Feb 7 2010 cgi-bin
drwxr-xr-x 3 root root 4096 Aug 20 2009 error
drwxr-xr-x 3 root root 4096 Aug 20 2009 htdocs
drwxr-xr-x 2 root root 4096 Aug 20 2009 html
drwxr-xr-x 3 root root 4096 May 16 00:07 icons
drwxr-xr-x 14 root root 4096 Aug 20 2009 manual
lrwxrwxrwx 1 root root 20 Nov 11 09:05 sarg -> /usr/local/sbin/sarg
drwxr-xr-x 2 webalizer root 4096 Nov 9 00:00 usage

[root www]# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda5 4956284 3942388 758064 84% /
/dev/sda3 4956316 2047384 2653100 44% /var
/dev/sda1 77749 23675 50060 33% /boot
tmpfs 475204 0 475204 0% /dev/shm
/dev/sda2 233345000 36083984 197261016 16% /var/spool/squid
/dev/sda2 233345000 36083984 197261016 16% /usr/local/sbin/sarg

/etc/fstab
LABEL=/ / ext3 defaults 1 1
LABEL=/var /var ext3 defaults 1 2
LABEL=/boot /boot ext3 defaults 1 2
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
LABEL=SWAP-sda6 swap swap defaults 0 0
/dev/sdb1 /var/spool/squid reiserfs defaults,notail,noatime 1 2

OK -- just that you mentioned it in post #3 of this thread and it's in fstab but not mounted so probably doesn't exist.

Thanks for the information.

Looks as if /dev/sda2 got mounted at /usr/local/sbin/sarg some time so the symlink results in writes to /var/www/sarg going to /dev/sda2 which is mounted at /var/spool/squid. Not ideal; any writes to files that happen to have the same name would result in overwriting data.

It's all a bit messy; perhaps the cleanest thing you can do now is create a /var/spool/squid/www/sarg directory and replace the symlink with one pointing to that (which is still a bit messy because nobody would expect the www logs to be in/under the squid logs).

For more tidying up, you might like to remove the /dev/sdb1 line from fstab and umount /usr/local/sbin/sarg.

Something wrong in my understanding then.
Why is it not possibler to mount more than 1 folder per drive?
Does that mean I have now messed up my squid cache mounted on the same drive?

If I unmount /usr/local/sbin/sarg where do I put it as it won't fit in it's current mount position?

In Linux-speak it's directory not folder and file system not drive. It nice when we speak the same language. After translation "mount more than 1 folder per drive" is "mount more than 1 directory per file system" but it's the wrong way round; file systems are mounted on directories (which are then known as mount points); directories are not mounted on file systems, they are created within them.

You can mount one file system on multiple directories; it has been done on your system. The problem is that apps tend to be designed with the assumption that they are the only users of their log directories. Supposing that your webserver and squid both write logs called 10-11-11.log. They would be writing to the same file and would overwrite each other's log data. Probably will not happen but if things can go wrong they often do and it's simple to avoid the danger by giving each its own log directory, which is the standard set up. Sysadmin is complicated enough as it is and a valuable simplifying principle is to do things in the standard way which is clean and easy to understand.

I already suggested one way of getting your daily reports written on the file system with the most space (creating a /var/spool/squid/www/sarg directory and making /var/www/sarg a symlink to it).

yeah, but like you said it's a bit messy.
Is my only other option to create an extra partition?

I don;t think the squid cache or sarg write out any log files to those directories as the logs are held elsewhere...

The cleanest options are (I am presuming you don't have a SAN which can supply storage space):

• Enlarge /var (which you have said you can't do because, unless the /var file system is dynamically resizeable, it means unmounting it and "it is a production server and would stop many things")
• Create a new partition and file system in it (which requires unused space on an HDD in the server or hot-pluggable into the server, such as an external USB HDD).
• Network mount a file system from another system (which has robustness issues but that may be OK for reports).

Can I create a partition on this drive while it is still being used?
/dev/sda2 233345000 42168532 191176468 19%
It is SCSI device A partition 2:
Size 222.54 GB / Free 188 GB

I'm wary of partitioning as stuff can go wring but I'm wary of creating a folder in /var/spool/squid as it might mess up the cache.