Linux with Operating System Concepts

PROBLEM 3: INADEQUATE HARD-DISK SPACE
Description: One or more of the file systems is filling up or has become full. Users cannot 
save files. Or, swap space is commonly low on available space.
Steps to determine the problem:
1. Use df to view how full each file system is.
2. Use find to search for inordinately large user files and core dumps (if /home is low on 
space), or log and spool files (if /var is low).
3. If swap space is low, examine swap history using vmstat, sar, and pidstat.
Short-term solutions: Back up the file system that is running out of space. Delete overly 
large files and warn the user/owner of the files (e.g., “I have removed several core dumps 
found in your directory”). Ask users to clean up their file space.
Long-term solutions: Back up all file systems. Purchase additional hard disks and either 
segment users onto different partitions (e.g., /home/1 and /home/2) or repartition the file 
system so that the partition can be moved either to the new hard disk or to be split across 
the hard disks. Implement disk quotas if necessary to prevent user spaces from filling up in 
the future. Initiate mail quotas. Move large log files to an archive.
PROBLEM 4: SUSPICIOUS SYSTEM BEHAVIOR
Description: Services or programs are not working as they should. System might be too 
slow. Files might have disappeared.
Steps to determine the problem:
1. Examine your log files, particularly secure, lastlog, and btmp, to look for unusual 
patterns of logins.
2. Look for running processes with peculiar ownership.
3. Use ausearch to look at authentication events, particularly failed ones.
4. Look for evidence of computer virus or Trojan horse.

---

610
◾
Linux with Operating System Concepts
Short-term solutions: Kill any suspicious processes (with apologies to any users who 
own these processes). Run antiviral software. Reboot the computer if needed. Examine 
your firewall to make sure it is running.
Long-term solutions: Implement a more secure authentication system and a more secure 
firewall. Implement an intrusion detection system. Discuss account protection with your 
users. Require all users to change passwords at the next log in. Delete any suspicious user 
accounts.