Weird /tmp problem

[Glenn Steen]

On 06/12/06, Scott Silva <ssilva at sgvwater.com> wrote:
> Gavin Nelmes-Crocker spake the following on 12/6/2006 7:56 AM:
> >> On 06/12/06, Ken A <ka at pacific.net> wrote:
> >>> You are running ls and df as root, right? Are you running any IDS? It's
> >>> good to rule out the worst case scenarios first, even if that might seem
> >>> paranoid. /tmp is an obvious target. ls output shouldn't conflict with
> >>> df output. check ls -la carefully for anything funny looking (a dir
> >>> beginning with a space, etc).
> >
> > Correct i am logged in as root when doing all tests/checks.  We're not
> > running any IDS on the server but have run chkrootkit and can see
> > nothing bad
> >
> >> Good sugegstions... Also... When you stop MailScanner, is the "lost
> >> space" suddenly available again?
> >
> > Yes - stop mailscanner and /tmp goes back to normal
> >
> > The difficulty is that i can only run tests that involve turning
> > Mailscanner back on late at night and for short periods of time due to
> > the email breaking.
> >
> > Here are the outputs I'm seeing now with everything working and looking
> > normal.
> >
> > df
> > Filesystem           1K-blocks      Used Available Use% Mounted on
> > /dev/md1               6190592   1378676   4497452  24% /
> > /dev/md0                101018     38557     57245  41% /boot
> > none                   1037728         0   1037728   0% /dev/shm
> > /dev/md4              64428444   9027064  52128548  15% /home
> > /dev/md2               1035596     34140    948848   4% /tmp
> > /dev/md3               4127040   1705624   2211772  44% /var
> > # cd /tmp/
> > # ls -al
> > total 48
> > drwxrwxrwt   6 root root   4096 Dec  6 15:48 .
> > drwxr-xr-x  24 root root   4096 Dec  4 13:51 ..
> > -rw-------   1 root root     50 Dec  5 23:45 ClamAVBusy.lock
> > drwxrwxrwt   2 root root   4096 Dec  4 13:51 .ICE-unix
> > drwx------   2 root root   4096 Apr  3  2006 lost+found
> > -rw-rw----   1 mail daemon  248 Dec  4 14:41 majordomo.debug
> > drwxr-xr-x   2 root root   4096 Dec  4 13:45 paletteStatus
> > -rw-rw----   1 mail daemon 6844 Dec  6 15:43 resend.debug
> > drwx------   2 root root   4096 Dec  6 15:48 ssh-uJlNFn3025
> > -r--r--r--   1 root root     24 Oct 23 20:42 yum.check-update
> >
> > I'll do the same later tonight with Mailscanner turned on - any other
> > ideas to try in preparation for testing?
> >
> > Thanks
> >
> > Regards
> >
> > Gavin
> Have you used du -f /tmp when the error occurs?
> That might give you a clue if a directory is filling up.
>
Another thing.... is that a "memory backed filesystem", like tmpfs or somesuch?
If so, does reveringt it to a normal filesystem, temporarily, just to
see if that fixes your problem... help (in the short term)?
What kind of size limits do you enforce (MTA, MS etc)?

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se