5.9: /var filling

[MatthiasKoch]

Good afternoon all,

I'm running a virtual (ESXi 5.5) OpenBSD 5.9 logstash server with logstash-2.1.1p0v0 from packages. It's only listening for remote machines and forwards their data to an Elasticsearch cluster (no other local application running).

The /var partition is small (1.7G) and fills for a reason I cannot find out.

[root@ymir]:/> uname -var
OpenBSD ymir 5.9 GENERIC.MP#1888 amd64

[root@ymir]:/> pkg_info logstash
Information for inst:logstash-2.1.1p0v0

[root@ymir]:/> df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
...
/dev/sd0e      1.7G    1.3G    343M    80%    /var

[root@ymir]:/> du -hs /var
10.8M   /var

This means, 1.3 out of 1.7G are used, but du only finds 10.8M (!) So what about the rest?
I'm a bit stuck atm... any input is welcome.

Matthias