Re: [tlug] how filesystem works?

["Stephen J. Turnbull" <stephen@example.com>]

Stuart Luppescu writes:

 > This is something I never understood. Someone told me to put /var in its 
 > own partition because if it fills us (with log files, or whatever) it 
 > will crowd out other stuff and make the computer unusable.

That's an inaccurate statement of the advantage.

If you do quarantine /var, you can boot to single-user (or simply stop
daemons etc that use /var, but that's tricky), find space on another
partition, mv (or "gzip >") the logs (mail spool, etc) there, and
restart the system.  Also, any write operation on another partition
will succeed, you won't lose data.

If you use a single partition for everything, you don't have that
option; you need to either delete stuff, which you probably don't want
to do without looking at it, or you have to move it to other media,
which is painful (no space means you can't burn CDs).  If you happen
to be writing a file with many changes and you run out of space,
rebooting means you lose all of that.

 > I did that, and then /var filled up, syslog and cron complained
 > about not being able to write files and the whole computer froze
 > up.

A freeze shouldn't happen.  You'll lose mail service and anything else
that spools to disk in /var, but any operation that doesn't write to
/var should proceed normally.

 > Now I put /var inside / and haven't had any problems.

Problems are less likely, but if you ever do have problems, you may be
in for a world of pain.

It's up to you to decide whether that matters.  Some people really
don't care about their logs, for example, and will be able to just
delete the 10GB net log that happened because of a DoS attack.  But if
you think you might ever need to use your logs in court, consider that
that action could cost you the ability to present your logs as
evidence: logs are hearsay unless you can show that you manage them
properly in the normal course of running your system.[1]


Footnotes: 
[1]  IANAL,TINLA.  Source: Bellovin and Cheswick, which is now way old.