Hi all, I'm getting warnings that one of my drives is 90% full but I can't find the files filling it up. Running "df -ha" shows: Filesystem Size Used Avail Use% Mounted on /dev/hda1 2.0G 789M 1.1G 42% / none 0 0 0 - /proc none 0 0 0 - /sys none 0 0 0 - /dev/pts usbfs 0 0 0 - /proc/bus/usb none 506M 0 506M 0% /dev/shm /dev/hda7 58G 1.9G 53G 4% /home /dev/hda6 2.0G 36M 1.9G 2% /tmp /dev/hda2 4.9G 2.6G 2.2G 55% /usr /dev/hda3 4.9G 4.2G 512M 90% /var <<<<<<< Problem disk none 0 0 0 - /proc/sys/fs/binfmt_misc sunrpc 0 0 0 - /var/lib/nfs/rpc_pipefs But running "du -sh *" from / shows /var as only having 322M (full output is below). Any hints on where I can find the files filling up /dev/hda3??? Thanks, Michael root@games [/]# du -sh * 8.0K aquota.user 6.4M bin 11M boot 168K dev 12K du_var 20M etc 8.0K hardware_status.html?mac=00:0C:F1:D7:9B:4B&action=update&status=RH_POST_KICKSTART &hk=cf36ac8c346755f3d318bbd694a168c7799c74de 1.7G home 8.0K initrd 129M lib 16K lost+found 16K media 8.0K misc 8.0K mnt 8.0K opt 0 pico 902M proc 8.0K quota.user 580M root 16M sbin 4.0M scripts 8.0K selinux 8.0K srv 0 sys 72K tftpboot 48K tmp 2.7G usr 322M var
On Tue, Dec 26, 2006 at 12:27:33PM -0500, Michael Zarozinski wrote:
/dev/hda3 4.9G 4.2G 512M 90% /var <<<<<<< root@games [/]# du -sh * 322M var
I would go to single user mode, unmount /var, and run a filesystem check on it. /sbin/telinit 1 umount /var /sbin/fsck -f /dev/hda3 You can also check for what is using the space on /var. I use du -sk so that I can sort the result in kilobytes: df -h /var df -hi /var du -sk /var/* | sort -n The last one won't catch files that begin with a ., so check for large dot files: ls -la /var du -sk /var/.[!.]* | sort -n
On Tue, Dec 26, 2006 at 12:27:33PM -0500, Michael Zarozinski wrote:
I'm getting warnings that one of my drives is 90% full but I can't find the files filling it up.
/dev/hda3 4.9G 4.2G 512M 90% /var <<<<<<<
But running "du -sh *" from / shows /var as only having 322M (full output is below).
Any hints on where I can find the files filling up /dev/hda3???
Aha! I actually ask this exact question during interviews. :) There could be several reasons, but a common reason is daemons which are still writing to log files which were deleted. Do something like "lsof | grep deleted" and see what's being used. For instance, on my system: python 2323 mailman 3u REG 8,2 0 75931863 /var/log/mailman/error.5 (deleted) So it appears that there was some issue when log rotating where the mailman proc didn't close the old file, so while it doesn't exist in the directory any longer (and therefore won't count via du) it still exists in the filesystem and takes up space (in this case, 0 bytes, but ...) -- randomly Selected Tagline: "I didn't have Scotch Tape for many years, but I sure as hell use it now." - Larry Young, 2002/06/16, discussion about not having email
Thank you! It was some daemons that didn't shut down properly! Theo Van Dinter wrote:
On Tue, Dec 26, 2006 at 12:27:33PM -0500, Michael Zarozinski wrote:
I'm getting warnings that one of my drives is 90% full but I can't find the files filling it up.
/dev/hda3 4.9G 4.2G 512M 90% /var <<<<<<<
But running "du -sh *" from / shows /var as only having 322M (full output is below).
Any hints on where I can find the files filling up /dev/hda3???
Aha! I actually ask this exact question during interviews. :)
There could be several reasons, but a common reason is daemons which are still writing to log files which were deleted. Do something like "lsof | grep deleted" and see what's being used. For instance, on my system:
python 2323 mailman 3u REG 8,2 0 75931863 /var/log/mailman/error.5 (deleted)
So it appears that there was some issue when log rotating where the mailman proc didn't close the old file, so while it doesn't exist in the directory any longer (and therefore won't count via du) it still exists in the filesystem and takes up space (in this case, 0 bytes, but ...)
------------------------------------------------------------------------
_______________________________________________ Wlug mailing list Wlug@mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug
participants (3)
-
Chuck Anderson -
Michael Zarozinski -
Theo Van Dinter