My /var just filled up, but some scripts immediately took action and archived logs. However, while at 100% full, someone was accessing the squid instance and it barfed: squid[4432]: diskHandleWrite: FD 110: disk write error: (28) No space left on device squid[4432]: storeAufsWriteDone: got failure (-6) squid[4432]: storeSwapOutFileClosed: dirno 0, swapfile 0000270E, errflag=-6 (28) No space left on device squid[4432]: WARNING: Shrinking cache_dir #0 to 898356 KB squid[4432]: commSetEvents: epoll_ctl(EPOLL_CTL_ADD): failed on fd=73: (1) Operation not permitted Two seconds later, /var had space again, but any attempt to connect to a webpage via squid got us a "connection refused" and squid kept writing squid[4432]: diskHandleWrite: FD 16: disk write error: (28) No space left on device squid[4432]: storeDirWriteCleanLogs: Starting... squid[4432]: WARNING: Closing open FD 16 until I restarted the process. squid should really be able to recover from this without having to be restarted. And ideally, it should respond to requests with a message alerting to the error, rather than a "connection refused". This is reproducible at will.