Fixing a full var file system

Here I listed some of the ways to fix a var file system.

Step 1:

Check for the large files that might be removed in the /var directory using the find command.

Step 2:

Check the /var/adm/wtmp for the logs of all logins, remote logins. If needed copy the contents of this file and clear it.
#cp /dev/null /var/adm/wtmp

Step 3:

Then clear the error log. Do not use the /dev/null file to clear the error log. Use the following procedure to clear the error log var/adm/ras.

#/usr/lib/errstop

#rm /var/adm/ras/errlog

#/usr/lib/errdemon

Step 4:

If /var/adm/ras/trcfile file is large and the trace is not currently running, we can remove it by

#rm /var/adm/ras/trcfile

Step 5:

Clear the vmcore files from the /var/adm/ras directory

Step 6:

Clear the queueing subsystem files from the /var/spool directory.

Step 7:

Check the /var/preserve directory for terminated vi sessions. It is safety to remove these files.

Fixing var file system

Here I listed some of the ways to fix a var file system.

Step 1:

Check for the large files that might be removed in the /var directory using the find command.

Step 2:

Check the /var/adm/wtmp for the logs of all logins, remote logins. If needed copy the contents of this file and clear it.
#cp /dev/null /var/adm/wtmp

Step 3:

Then clear the error log. Do not use the /dev/null file to clear the error log. Use the following procedure to clear the error log var/adm/ras.

#/usr/lib/errstop

#rm /var/adm/ras/errlog

#/usr/lib/errdemon

Step 4:

If /var/adm/ras/trcfile file is large and the trace is not currently running, we can remove it by

#rm /var/adm/ras/trcfile

Step 5:

Clear the vmcore files from the /var/adm/ras directory

Step 6:

Clear the queueing subsystem files from the /var/spool directory.

Step 7:

Check the /var/preserve directory for terminated vi sessions. It is safety to remove these files.

Fixing a full root file system

Step 1:

Read the contents of the /etc/security/failedlogin and if needed, backup the content of this file. Then remove the entries by using the following command.

#cp /dev/null /etc/security/failedlogin

Step 2:

Check the /dev directory. If there is any duplicate entry i.e. invalid device names (for ex. rmto instead of rmt0), remove it.

Step 3:

Check for very large files that might be removed. This can be done by using find command.

Before removing the large files, check whether the file is currently being used by the user. This can be done by the fuser filename command.