Winfried Truemper writes:
:>There is a script included in debian and it rotates (instead of just
:>deleting or cutting) the file. But maybe rotating it once a week is
:>not sufficient.
For some people it may be sufficient, for some not. My home
machine restarts process accounting once a day, another machine
restarts it hourly (and then compresses the old accounting file).
:>I know it was not a good idea to delete the file before swichting of
:>process accounting, but I told the whole story for completeness.
:>Yesterday, I _did_ swichted of PA _before_ deleting the file but it
:>didn't make any difference.
Maybe you unmounted /var too fast and for some reason kernel
didn't yet mark those blocks used earlier by PA file being free?
If so, this may be a bug somewhere else in kernel. Your e2fsck
output just showed that it marked a lot of blocks free as they
were marked used but they didn't belong to any existing file.
:>jiivee> I haven't seen that kind of filesystem corruption ever. Few times
:>jiivee> syslog files have _completely_ filled up /var (where also process
:>jiivee> accounting file resides), but no filesystem corruption have
:>jiivee> occurred.
:>
:>I don't refer to "syslog". It was the process-accounting, which filled
:>up `/var'.
Sure, but all system log files reside in /var. I meant to say
that when I had /var completely filled up (due to huge amount of
logged errors via syslog), PA was active all the time and no file
system corruption occurred for me. (I suppose syslogd does
something clever, like closes syslog files in case of write
errors.)
Juha
-- jiivee@iki.fi http://www.iki.fi/jiivee/