On Tue, Dec 26, 2006 at 12:27:33PM -0500, Michael Zarozinski wrote:
I'm getting warnings that one of my drives is 90% full but I can't find the files filling it up.
/dev/hda3 4.9G 4.2G 512M 90% /var <<<<<<<
But running "du -sh *" from / shows /var as only having 322M (full output is below).
Any hints on where I can find the files filling up /dev/hda3???
Aha! I actually ask this exact question during interviews. :) There could be several reasons, but a common reason is daemons which are still writing to log files which were deleted. Do something like "lsof | grep deleted" and see what's being used. For instance, on my system: python 2323 mailman 3u REG 8,2 0 75931863 /var/log/mailman/error.5 (deleted) So it appears that there was some issue when log rotating where the mailman proc didn't close the old file, so while it doesn't exist in the directory any longer (and therefore won't count via du) it still exists in the filesystem and takes up space (in this case, 0 bytes, but ...) -- randomly Selected Tagline: "I didn't have Scotch Tape for many years, but I sure as hell use it now." - Larry Young, 2002/06/16, discussion about not having email