Hello, sorry if this is already posted in the forum, I couldn't find anything.

Out of the blue I started getting php session path errors about can't write to disk, not enough disk space but the filesystem /var is on has plenty of space. I noticed I can't even touch a new file in the /var tree, I'd get a similar warning about disk space full. I checked the inodes with df -i and sure enough /var is 100% in use.

I grepped for small files in var using:
for i in /var/*; do echo $i; find $i |wc -l; done

And it hangs in the /var/asl directory which tells me there are a lot of little files in there. How can I fix this problem without removing all of asl's rule files or other things it needs. Is there a log directory that isn't being cleaned out or something? I'd rather not have to create an entirely new filesystem if I can avoid it.

Thanks

Looks like its the /var/asl/data/audit directory. Is it safe to clear out these files? If not any other tips to avoid this in the future?

You can set the retention for the files in that directory with MODSEC_CLEAN_ALERT, the default is to keep the data for 30 days.

Sorry for the dumb question but I can't figure out how to restart asl after editing the config so it will take in the new settings. I searched the wiki and support forums.. Also not seeing it in asl help

You update the policy with: asl -s -f

when you do this through ASL Web it takes care of that when you hit the "Update" button.