SUMMARY: root filesystem filling up

From: Jonathan Williams (jonathw_at_shubertorg.com)
Date: 05/21/03

  • Next message: NotariE_at_usa.redcross.org: "Looking for a SEYON like emulator for Tru64" 
    Date: Wed, 21 May 2003 13:42:52 -0400
To: tru64-unix-managers@ornl.gov

    AHA!! I have found the evil culprit (a developer...imagine that)!! I'm
    sure you all knew this, but it was news to me:

    Dr. Blinn explained it well:
            "The most likely consumer of space in the root file system is something
            (aka someone) writing a file in /tmp. Unfortunately, some programs that
            write files in /tmp are good enough to create the file, then once they
            have it open, unlink it so that if the system fails before they exit,
            it will be cleaned up at the next boot "automatically" (by the normal
            file system checks). Thus, they can write the file and read it and so
            on and there is no entry (any longer) in the directory; so all that you
            can see with the techniques you used is that the directory changed when
            the file was created and removed (that's when the directory is updated),
            and since the file entry no longer exists in the directory, you can't
            find the file itself, even though it takes up space. Of course, any
            privileged program can write files in other directories in the root
            file system, but usually they don't."

    So as many of you suggested I used "fuser -d" which will:
    ---------
    -d Report any referenced files that have been deleted including the
                referencing PID and the block count for the file in 512 byte
                block units.
    ---------

    And sure enough, there was one thing sitting out there taking up exactly as much
    space as is missing. Turns out it is a developer using Crisp, and it is doing
    exactly what Dr. Blinn described.

    So that's the end of that mystery. Thank you to all who responded (and so very
    quickly as well).

    Jonathan Williams
    Unix Systems Administrator
    The Shubert Organization, Inc.

    ----- Original Message -----
    From: "Jonathan Williams" <jonathw@shubertorg.com>
    To: <tru64-unix-managers@ornl.gov>
    Sent: Wednesday, May 21, 2003 1:01 PM
    Subject: root filesystem filling up

    > I've got a system here--Alphaserver ES40, running Tru64 5.1a (no patches). I
    > was looking at disk space (or lack thereof), and noticed that the root
    > filesystem is filling up--but I can't find out where the space is going. The
    > root filesystem has been at the same
    > %used for at least the last 6 months, but now all of a sudden something is
    being
    > written here.
    >
    > I did an ls -tl on / and the only two directories with today's date on them
    are
    > /proc and .sh_history. I figured if a file was being written or something,
    then
    > the directory that it is in would have it's timestamp updated. I looked in
    the
    > /tmp directory and found nothing of any significance. I also did a find
    > . -mtime 1 -print but nothing really came up (except a bunch of stuff from
    > /proc, and stuff from other filesystems).
    >
    > So I was just wondering how I could go about finding out what is using this
    > space up? I'm sure there is some trick to it that I'm not aware of. Thanks
    in
    > advance for any advice.
    >
    > Jonathan Williams
    > Unix Systems Administrator
    > The Shubert Organization, Inc.
    >
    >
    >

  • Next message: NotariE_at_usa.redcross.org: "Looking for a SEYON like emulator for Tru64"