Cisco Prime Infrastructure 3.1 /var full

[victor.mansson]

Hey

We're getting notificationsfrom our VMware about Cisco Prime Infrastructure's /var partition is full.
After logging on to shell and run df -h I get the following:
/dev/mapper/smogsvg-varvol
Size: 3.9G Available:0 Use: 100% Mounted on: /var

Can't find any information about the /var partition or how to clean it up. I've run the normal ncs cleanup without success.

Can anyone point me in the right direction?

[marce1000]

  - You can become root on  the prime server if logged via ssh (admin account only) and issue the shell command and afterwards 'sudo -s'.  You can find the biggest files in the /var directory , then using,for instance :

                       find /var -mount -printf '%s %p\n' | sort -nr | head -10

M.

[victor.mansson]

Thansk for the information.

Found out that is was the logfiles from /var/cache/logwatch/ that was eating up the space.

Got some help from 
https://supportforums.cisco.com/discussion/13194071/cisco-prime-infra-31-does-not-start

and

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb45802

[victor.mansson]

1. SSH to your Prime Infrastructure

2. Login and then typ: shell and login again

3. Run sudo su -

4. run df -h to check the diskspace

5. run cd /var/cache/logwatch/

6. run ls -l to view files

7. run rm -rf logwatch.{filename} to delete a file or logwatch.* to delete all

[cer3100276]

Vider le fichier /var/log/wtmp

[michael.bungard1]

ran into an issue with prime not booting.

followed advice from this thread and did the:

shell

sudo su -

 find /var -mount -printf '%s %p\n' | sort -nr | head -10

Found that the largest file by far was:

/var/log/wtmp

Did the following:

cd /var/log/

rm -rf wmtmp

exit

exit

Restarted the appliance

wmtmp appears to be a swap file that must not be important since PI was able to boot up with no issues following its' removal.