J.O. Aho wrote:
>>>> Can anyone me please? I don't see where the error is and why it's
>>>> only occurring for 3 hours in the morning. Thank you.
>>> Something else is using up a lot of space around that time.
>> Yup. Can't tell from looking now how full the disk was then, aside from
>> maybe seeing in some other logs as well. Maillog might be a good one to
>> check, as typically mail systems (even ones on database servers) use
>> /var/spool for things.
>
> A spam relay may be a cause for a such sudden extra usage of disk space.
>
The MTA is configured to act only locally and is bound to the
loopback-interface, port 25 is firewalled.

>
>>>> And I found a nice correlation: my logs got rotated at 12.20 or whichever
>>>> time it was on the other days. There was a defunct logrotate-process in my
>>>> ps-output. Maybe it works after I kill it?!
>
> A defunct logrotate should just lead to that the rotation ain't done and the
> "original" logfile keeps on growing instead of starting on a new one. But you
> could try to kill it off and see what happens, it's not the whole world if a
> log don't get rotated once in a while.
>
If I understand logrotate correctly, it's started by cron daily, in my
config that's around 6am. It should exit when it has finished rotating
the logs. So a still-running logrotate would be quite unusual.