Need step by step instructions on how to solve this. I have a 37 gig harddrive and I think it's just full of log files. How do I find the largest files and do I just rm filename? I run freebsd.

bash-2.05# cd /var
bash-2.05# ls -lt | head
total 18
drwxr-xr-x 3 root wheel 2048 May 5 00:00 log
drwxr-xr-x 2 root wheel 512 May 4 03:03 run
drwxr-xr-x 2 root wheel 512 May 4 03:01 account
drwxr-x--- 2 root wheel 512 Apr 19 03:01 backups
drwxrwxr-x 2 root mail 512 Apr 18 07:16 mail
drwxrwxrwt 3 root wheel 512 Apr 18 07:16 tmp
drwxr-xr-x 2 daemon wheel 512 Jan 28 13:56 msgs
drwxrwxr-x 5 root games 512 Jan 28 05:51 games
drwxr-xr-x 3 root wheel 512 Jan 28 05:51 db
bash-2.05# ls
account crash games mail run tmp
at cron heimdal msgs rwho yp
backups db log preserve spool
bash-2.05# cd log
bash-2.05# ls
console.log lastlog messages.12.gz messages.6.gz sendmail.st.6
console.log.0.gz lpd-errs messages.13.gz messages.7.gz sendmail.st.7
console.log.1.gz maillog messages.14.gz messages.8.gz sendmail.st.8
console.log.2.gz maillog.0.gz messages.15.gz messages.9.gz sendmail.st.9
console.log.3.gz maillog.1.gz messages.16.gz mount.today setuid.today
console.log.4.gz maillog.2.gz messages.17.gz ncftpd slip.log
console.log.5.gz maillog.3.gz messages.18.gz ppp.log userlog
cron maillog.4.gz messages.19 security wtmp
cron.0.gz maillog.5.gz messages.2.gz sendmail.st wtmp.0
cron.1.gz maillog.6.gz messages.20.gz sendmail.st.0 wtmp.1
cron.2.gz maillog.7.gz messages.21.gz sendmail.st.1 wtmp.2
cron.3.gz messages messages.22.gz sendmail.st.10 wtmp.3
dmesg.today messages.0.gz messages.23.gz sendmail.st.2 xferlog
dmesg.yesterday messages.1.gz messages.3.gz sendmail.st.3
ipfw.today messages.10.gz messages.4.gz sendmail.st.4
ipfw.yesterday messages.11.gz messages.5.gz sendmail.st.5

bash-2.05# df -k
Filesystem 1K-blocks Used Avail Capacity Mounted on
/dev/da0s1a 32705558 30544480 -455366 102% /
procfs 4 4 0 100% /proc

du -h

What does that do?

bash-2.05# du -h
1.0K .

Are your logs in /var? if so, try du -h /var

bash-2.05# du -h /var
1.6M /var/account
1.0K /var/at/jobs
1.0K /var/at/spool
3.0K /var/at
12K /var/backups
2.0K /var/crash
2.0K /var/cron/tabs
3.0K /var/cron
9.0K /var/db/pkg/lynx-2.8.4.1
5.0K /var/db/pkg/ncftp3-3.0.3
4.0K /var/db/pkg/tcsh-6.11.00
5.0K /var/db/pkg/bash-2.05
10.0K /var/db/pkg/gettext-0.10.35
6.0K /var/db/pkg/wget-1.7_3
4.0K /var/db/pkg/pico-4.0
8.0K /var/db/pkg/snort-1.8.1_1
5.0K /var/db/pkg/logcheck-1.1.1
5.0K /var/db/pkg/gmake-3.79.1
4.0K /var/db/pkg/memtest-2.93.1
66K /var/db/pkg
988K /var/db
1.0K /var/heimdal
64M /var/log/ncftpd
66M /var/log
1.0K /var/mail
2.0K /var/msgs
1.0K /var/preserve
50K /var/run
1.0K /var/rwho
1.0K /var/spool/lock
1.0K /var/spool/lpd
25K /var/spool/mqueue
1.0K /var/spool/opielocks
1.0K /var/spool/output/lpd
2.0K /var/spool/output
1.0K /var/spool/uucp/.Preserve
1.0K /var/spool/uucp/.Sequence
1.0K /var/spool/uucp/.Status
1.0K /var/spool/uucp/.Temp
1.0K /var/spool/uucp/.Xqtdir
6.0K /var/spool/uucp
1.0K /var/spool/uucppublic
38K /var/spool
81K /var/tmp/vi.recover
82K /var/tmp
20K /var/yp
1.0K /var/games/hackdir/save
2.0K /var/games/hackdir
1.0K /var/games/larn
1.0K /var/games/phantasia
5.0K /var/games
69M /var

take a look at
64M /var/log/ncftpd
66M /var/log

Seems that your biggest logs are there.

Those are pretty small files. Something is taking up gigs of space

do a df -h and paste the resoult here please.

bash-2.05# /var/log/ncftpd
bash: /var/log/ncftpd: is a directory
bash-2.05# cd /var/log/ncftpd
bash-2.05# df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/da0s1a 31G 29G -319.2M 101% /
procfs 4.0K 4.0K 0B 100% /proc
bash-2.05# cd /var/log
bash-2.05# df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/da0s1a 31G 29G -311.7M 101% /
procfs 4.0K 4.0K 0B 100% /proc
bash-2.05# du -h /var/log
64M /var/log/ncftpd
67M /var/log
bash-2.05# du -h /var/log/ncftpd
64M /var/log/ncftpd
bash-2.05#

How do I use du to only list files of folders containing more than 40 MB of space?

Someone is using my server for warez. I and naming them sky_XXX can I get rid or anything named sky automaticly?

if you found where those files are delete them and close that account.

This guy made hundreds of accounts and the file names are almost ways the same. Is there a faster way to do it then manually go into every folder, highlight the files and delete them?

if the path to the files are something like

/home/accountsname/www/sky_XXX.rar

try rm /home/*/*/sky_*.rar

I don't suggest to use rm -f because it this way (without the -f) you can monitor which files are you deleting.

Maybe I need a script. He made far too many account names

I'm sure you can go on irc and get someone to code you a quick perl script that will do what you want....

Where? Not many people will help people write scripts for free and what if the guy isn't very good and it ends up deleting files you don't want deleted? =/

what if you do a
locate sky_
Then you can get a list of that files that start with sky_, you'll see if its safe to do a rm -f /home/*/*/sky_*

locate works great =/ can you use locate and delete sky? Then my problems would be solved

Heres a sample of what his guy is doing. He must have a script to auto generate accounts and auto upload cause he has hundreds of accounts.


/httpdocs/zouotl/sky_disc4_fao.jpg
/httpdocs/burfyz/sky_disc1_ffk.jpg
/httpdocs/cpklnm/sky_disc2_azg.jpg
/httpdocs/fpmxap/sky_disc4_bpd.jpg
/httpdocs/hmttzm/sky_disc5_alj.jpg
/httpdocs/hopjdk/sky_disc3_bng.jpg

why don't you do then

rm -f /httpdocs/*/sky_disc* ?

bash: /bin/rm: Argument list too long

Try the following:

for file in `locate sky_*`; do rm -f $file; done

You can modify the script to work however you like. You may want to replace the "locate" command to a "find" if you wanted to search for files of a certain size in a particular directory. Also notice that those are backticks in the script, not single quotes.

<EDIT>The "locate" database will have to be up to date for it to find all the recent files you want to delete (locate -u).</EDIT>

Did you kicked him from your server allready ??

Are you trying to remove all of the users account directories that have files with sky in the filenames? or just the files themselves?

I'd be willing to throw together a perl program (no cost) that would do what you need. However I do need to know exactly what this script needs to do; remove the directories that the users files reside in or just the files. I'd also need to know your systems paths (perl, the location of the files) and if you would like it to just wipe all of them out or have you confirm every file deletion (recommended).

Let me know and I'll throw something together.