Fix a full /var Filsystem

You have to do the following Steps:

1. You can use the find command to look for large files in the /var directory. For
example:
# find /var -xdev -size +2048 -ls| sort -r +6

2. Check for obsolete or leftover files in /var/tmp.

3. Check the size of the /var/adm/wtmp file, which logs all logins, rlogins and
telnet sessions. The log will grow indefinitely unless system accounting is
running. System accounting clears it out nightly. The /var/adm/wtmp file can
be cleared out or edited to remove old and unwanted information. To clear it,
use the following command:
# cp /dev/null /var/adm/wtmp

4. Clear the error log in the /var/adm/ras directory using the following procedure.
The error log is never cleared unless it is manually cleared.

a. Stop the error daemon using the following command:
# /usr/lib/errstop

b. Remove or move to a different file system the error log file by using one of
the following commands:
# rm /var/adm/ras/errlog
or
# mv /var/adm/ras/errlog filename

c. Restart the error daemon using the following command:
# /usr/lib/errdemon


5. Check whether the trcfile file in this directory is large.
If it is large and trace is not currently being run,
you can remove the file using the following
command:
# rm /var/adm/ras/trcfile

6. If your dump device is set to hd6 (which is the default), there might be a
number of vmcore* files in the /var/adm/ras directory. If their file dates are old
or you do not want to retain them, you can remove them with the rm
command.

7. Check the /var/spool directory, which contains the queuing subsystem files.
Clear the queuing subsystem using the following commands:
# stopsrc -s qdaemon
0513-044 The qdaemon Subsystem was requested to stop.
# rm /var/spool/lpd/qdir/*
# rm /var/spool/lpd/stat/*
# rm /var/spool/qdaemon/*
# startsrc -s qdaemon
0513-059 The qdaemon Subsystem has been started. Subsystem PID is 291042.
#

8. Check the /var/adm/acct directory, which contains accounting records. If
accounting is running, this directory may contain several large files.

9. Modify the /var/tmp/snmpd.log, which records events from the snmpd daemon.
If the file is removed it will be recreated by the snmpd daemon.

10. Modify the /var/adm/sulog file, which records the number of attempted uses of
the su command and whether each was successful. This is a flat file and can
be viewed and modified with a favorite editor. If it is removed, it will be
recreated by the next attempted su command