Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It seems that when you run out of disk space all remote logins are prevented [I'm using Red Hat 4.4]. Apparently this is because all non-superuser logins have to write to /var/log/auth.log

This is a common occurence when /var/tmp/cores gets filled due to (user) programs crashing, or a process generating tons of log (under /var/tmp).

What configuration changes can be made to prevent this occurring?

Can + do you:

  • put /var/tmp on a different filesystem?
  • put /var/log on different filesystem?
  • enforce a strict separate of filesystems accessible user + system processes?
share|improve this question
1  
And what do you do, when the other filesystem is full, too? You'll not be able to login either. You need to react when the filesystem reaches the limit, either manually or automatic. –  ott-- Dec 27 '12 at 11:50
1  
RHEL4 is not supported anymore iirc, you should migrate :) –  coincoin Dec 27 '12 at 13:43
    
No, RHEL4 is still supported under ELS subscription ;) –  Soham Chakraborty Dec 27 '12 at 14:25
    
@SohamChakraborty Nobody's paying me to support RHEL4 anymore. –  Michael Hampton Dec 27 '12 at 16:20

1 Answer 1

up vote 4 down vote accepted

There are several things that you need to do to prevent problems and possibly system crash in the future:

  1. Create separate partitions for /var, /var/log, /tmp and possibly others to help your system survive (hopefully) in case of one partition got filled accidentally.
  2. Use reasonable logrotate configuration to allow a good amount of logs and not consuming a lot of space. You can also compress the logs to reduce log size.
  3. Run some monitoring tools to inform you early enough when you are about to exceed some configured threshold such 50% or 75% of your partition(s).
  4. Fix any buggy software or lower the debug level when applicable and not needed. BTW, lowering debug level will improve performance.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.