From owner-freebsd-questions@FreeBSD.ORG Sun Sep 11 23:05:03 2011 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 44355106564A for ; Sun, 11 Sep 2011 23:05:03 +0000 (UTC) (envelope-from illoai@gmail.com) Received: from mail-fx0-f54.google.com (mail-fx0-f54.google.com [209.85.161.54]) by mx1.freebsd.org (Postfix) with ESMTP id C82D38FC0A for ; Sun, 11 Sep 2011 23:05:02 +0000 (UTC) Received: by fxg9 with SMTP id 9so650898fxg.13 for ; Sun, 11 Sep 2011 16:05:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=RgahFUhS7Y1G16IlW01O/dr7zHdz/0hrorlMW2EOvs0=; b=jeX7XCySkuSM/IB4DiC0TYHpY6KZLW8mPx4zUdfrrAOom1UKPUqFt7iPNxbt7LHjHW T71EiXN1TOAzl+Naiw57G/mqymt4OOkxXygEJb25mpJQyFv24HpgP+/Uerf8tv/6q/Ml PLXPCt8sEIJpKi8Narz9mA9PPMuwnMEauz4v8= MIME-Version: 1.0 Received: by 10.223.62.212 with SMTP id y20mr364522fah.111.1315780433925; Sun, 11 Sep 2011 15:33:53 -0700 (PDT) Received: by 10.223.75.205 with HTTP; Sun, 11 Sep 2011 15:33:53 -0700 (PDT) In-Reply-To: <955223604.20110912012332@yandex.ru> References: <955223604.20110912012332@yandex.ru> Date: Sun, 11 Sep 2011 18:33:53 -0400 Message-ID: From: "illoai@gmail.com" To: =?KOI8-R?B?68/O2MvP1yDl18fFzsnK?= Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: quoted-printable Cc: freebsd-questions@freebsd.org Subject: Re: How to check where space is LOST X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 11 Sep 2011 23:05:03 -0000 2011/9/11 =EB=CF=CE=D8=CB=CF=D7 =E5=D7=C7=C5=CE=C9=CA : > Hi. > > I notice that some times /var is overfull > > # df -h > Filesystem =9A =9A Size =9A =9AUsed =9A Avail Capacity =9AMounted on > /dev/ad1s1a =9A =9A496M =9A =9A239M =9A =9A217M =9A =9A52% =9A =9A/ > devfs =9A =9A =9A =9A =9A1.0K =9A =9A1.0K =9A =9A =9A0B =9A 100% =9A =9A/= dev > /dev/ad1s1e =9A =9A124M =9A =9A 40K =9A =9A114M =9A =9A 0% =9A =9A/tmp > /dev/ad1s1f =9A =9A1.8G =9A =9A1.1G =9A =9A596M =9A =9A65% =9A =9A/usr > /dev/ad1s1d =9A =9A989M =9A =9A349M =9A =9A561M =9A =9A38% =9A =9A/var > devfs =9A =9A =9A =9A =9A1.0K =9A =9A1.0K =9A =9A =9A0B =9A 100% =9A =9A/= var/named/dev > > # cd /var/ > > # du -h -d 1 > 2.0K =9A =9A./.snap > 2.0K =9A =9A./account > 6.0K =9A =9A./at > 2.0K =9A =9A./audit > =9A12K =9A =9A./backups > 4.0K =9A =9A./crash > 4.0K =9A =9A./cron > 2.0K =9A =9A./empty > 2.0K =9A =9A./heimdal > =9A79M =9A =9A./log > =9A19M =9A =9A./mail > 4.0K =9A =9A./msgs > 159K =9A =9A./named > 2.0K =9A =9A./preserve > =9A60K =9A =9A./run > 2.0K =9A =9A./rwho > =9A70K =9A =9A./spool > =9A14K =9A =9A./tmp > =9A24K =9A =9A./yp > 2.0K =9A =9A./games > 2.0K =9A =9A./agentx > =9A22K =9A =9A./net-snmp > 4.0K =9A =9A./lost+found > =9A98M =9A =9A. > > If I just #reboot system. I get that on /var is only 98M used. > > # df -h > Filesystem =9A =9A Size =9A =9AUsed =9A Avail Capacity =9AMounted on > /dev/ad1s1a =9A =9A496M =9A =9A239M =9A =9A217M =9A =9A52% =9A =9A/ > devfs =9A =9A =9A =9A =9A1.0K =9A =9A1.0K =9A =9A =9A0B =9A 100% =9A =9A/= dev > /dev/ad1s1e =9A =9A124M =9A =9A 40K =9A =9A114M =9A =9A 0% =9A =9A/tmp > /dev/ad1s1f =9A =9A1.8G =9A =9A1.1G =9A =9A596M =9A =9A65% =9A =9A/usr > /dev/ad1s1d =9A =9A989M =9A =9A 98M =9A =9A891M =9A =9A12% =9A =9A/var > devfs =9A =9A =9A =9A =9A1.0K =9A =9A1.0K =9A =9A =9A0B =9A 100% =9A =9A/= var/named/dev > > How to obtain what take space on /var > You probably have a process that is holding a file open that has been rotated or deleted. Probably a log file. sysutils/lsof can help. Also, once you track down which process is holding open files, you should try to find out why (/etc/syslog.conf is a suspect, obviously). --=20 --