[lug] Disk usage discrepancy?

[Justin-lists]

Well it seems like Apache was the culprit after all. When I added all my apache logs back into logrotate I never completely stopped and started apache, I just did a restart. I shut apache down completely and started it back up fresh around noon today. The disk space did not seem to change immediatly but I just checked again a few minutes ago and:

[glowecon at oldschool proc]$ df -h |grep var
/dev/hda3             980M  105M  825M  12% /var

[glowecon at oldschool proc]$ sudo du -hs /var
89M     /var

So the numbers now look more realistic. I did the following as suggested:

[glowecon at oldschool proc]$ sudo ls -al */fd | grep deleted
lrwx------    1 root     root           64 Feb 26 17:09 4 -> /tmp/session_mm_apache0.sem (deleted)
lrwx------    1 root     root           64 Feb 26 17:09 4 -> /tmp/session_mm_apache0.sem (deleted)
<whole bunch more of the same snipped out)

and...

[glowecon at oldschool proc]$ grep deleted */maps
Binary file 27688/maps matches
Binary file 27690/maps matches
29530/maps:403c8000-404ca000 rw-s 00000000 00:04 458752     /SYSV00000000 (deleted)
<whole bunch of the same snipped>

Not exactly sure what that stuff means but my disk space is free'd up now :)

Justin

--
glow at jackmoves.com


---------- Original Message -----------
From: Zan Lynx <zlynx at acm.org>
To: lug at lug.boulder.co.us
Sent: 26 Feb 2003 16:20:27 -0700
Subject: Re: [lug] Disk usage discrepancy?

> On Wed, 2003-02-26 at 15:59, Joseph McDonald wrote:
> > On Wed, Feb 26, 2003 at 12:10:27PM -0500, Michael D. Hirsch wrote:
> > > Another possibility is that you are running some kind of log watching 
> > > program and log files are kept open even after they have been removed.  
> > > You might try rebooting and see if that discrepancy is still there.
> > 
> > Yeah, I've learned the hardway that if you remove a file that's still
> > being written to by a process the inode sticks around until the file system
> > is fsck'ed. You probably don't want to unmount /var on a running system..
> > So, a reboot may be in order.
> 
> The file should be removed as soon as the process using it closes its
> last file handle.  If the unlinked file is still hanging around,
> something else is wrong.
> 
> One way to find deleted files that are being used is the /proc
> filesystem.  As root, do this:
> 
> cd /proc
> ls -al */fd | grep deleted
> grep deleted */maps
------- End of Original Message -------