From: Jonathan Williams (jonathw@shubertorg.com)
Date: Wed May 21 2003 - 13:42:52 EDT
AHA!! I have found the evil culprit (a developer...imagine that)!! I'm
sure you all knew this, but it was news to me:
Dr. Blinn explained it well:
"The most likely consumer of space in the root file system is something
(aka someone) writing a file in /tmp. Unfortunately, some programs that
write files in /tmp are good enough to create the file, then once they
have it open, unlink it so that if the system fails before they exit,
it will be cleaned up at the next boot "automatically" (by the normal
file system checks). Thus, they can write the file and read it and so
on and there is no entry (any longer) in the directory; so all that you
can see with the techniques you used is that the directory changed when
the file was created and removed (that's when the directory is updated),
and since the file entry no longer exists in the directory, you can't
find the file itself, even though it takes up space. Of course, any
privileged program can write files in other directories in the root
file system, but usually they don't."
So as many of you suggested I used "fuser -d" which will:
---------
-d Report any referenced files that have been deleted including the
referencing PID and the block count for the file in 512 byte
block units.
---------
And sure enough, there was one thing sitting out there taking up exactly as much
space as is missing. Turns out it is a developer using Crisp, and it is doing
exactly what Dr. Blinn described.
So that's the end of that mystery. Thank you to all who responded (and so very
quickly as well).
Jonathan Williams
Unix Systems Administrator
The Shubert Organization, Inc.
----- Original Message -----
From: "Jonathan Williams" <jonathw@shubertorg.com>
To: <tru64-unix-managers@ornl.gov>
Sent: Wednesday, May 21, 2003 1:01 PM
Subject: root filesystem filling up
> I've got a system here--Alphaserver ES40, running Tru64 5.1a (no patches). I
> was looking at disk space (or lack thereof), and noticed that the root
> filesystem is filling up--but I can't find out where the space is going. The
> root filesystem has been at the same
> %used for at least the last 6 months, but now all of a sudden something is
being
> written here.
>
> I did an ls -tl on / and the only two directories with today's date on them
are
> /proc and .sh_history. I figured if a file was being written or something,
then
> the directory that it is in would have it's timestamp updated. I looked in
the
> /tmp directory and found nothing of any significance. I also did a find
> . -mtime 1 -print but nothing really came up (except a bunch of stuff from
> /proc, and stuff from other filesystems).
>
> So I was just wondering how I could go about finding out what is using this
> space up? I'm sure there is some trick to it that I'm not aware of. Thanks
in
> advance for any advice.
>
> Jonathan Williams
> Unix Systems Administrator
> The Shubert Organization, Inc.
>
>
>
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:49:19 EDT