VNX: Root partition filling up due to logwatch. (User Correctable)

Brief Description:  dskMon[28444]: FS /dev/hda3 mounted on / filling up (at 100%, max = 90%).
 
Full Description: The feature identified has detected a potential capacity issue that may need the attention of the system administrator. The device name and mount point is indicated in the event posting.
 
Recommended Action: Check that the mount points condition is in fact approaching cautionary levels. Use normal administrative procedures to see if some free space can be returned to the mount point, such as removing unnecessary files or reorganizing areas of this mount point off onto other less full mount points on the system. If no means are available to reduce the space consumption on this mount point then you may want to investigate if there is a possibility that this mount point needs to be expanded to allow for more free space. Contact your Authorized Service Provide if you need assistance with this process or need to discuss acquiring additional storage system capacity.




# df /dev/hda3
File system           1K-blocks      Used Available Use% Mounted on
/dev/hda3              2063536   1995112         0 100% /

Logwatch is being used for Linux as a customizable, pluggable log-monitoring system. It will go through the logs for a given period of time and make a report in the areas that you wish with the detail that you wish.

Cleanup the /var/cache/logwatch/* to get some free space in root partition /dev/hda3

We can disable and enable Logwatch on control station.It is a Linux utility.

Logwatch is usually started by cron. Check directory /etc/cron.daily/ for a script which launches logwatch. In RHEL there is a symlink /etc/cron.daily/0logwatch which points to /usr/share/logwatch/scripts/logwatch.pl

You can remove this link (0logwatch) from /etc/cron.daily to prevent logwatch from running every day:
# rm /etc/cron.daily/0logwatch

To enable it back just create a symlink again(http://serverfault.com/questions/499513/enable-disable-log-watch-feature-in-linux-server): 
# ln -s /usr/share/logwatch/scripts/logwatch.pl /etc/cron.daily/0logwatch

Log Watch Archive Files May fill up /var/cache/logwatch/logwatch http://www.scratchyourself.com/logwatch-files-filling-up-server-var-cache-tmp-conf/
Remove those Archive Files as below:
# rm -rf /var/cache/logwatch/*

This may fill back up in 5 - 10 days.Recommend checking how often the Monitoring software Polls the CS and Reduce the number of Polls as needed.