From owner-freebsd-security Mon Nov 2 23:14:05 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id XAA28692 for freebsd-security-outgoing; Mon, 2 Nov 1998 23:14:05 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from henry.cs.adfa.oz.au (henry.cs.adfa.oz.au [131.236.21.158]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id XAA28680 for ; Mon, 2 Nov 1998 23:14:02 -0800 (PST) (envelope-from wkt@henry.cs.adfa.oz.au) Received: (from wkt@localhost) by henry.cs.adfa.oz.au (8.7.5/8.7.3) id SAA08483; Tue, 3 Nov 1998 18:14:05 +1100 (EST) From: Warren Toomey Message-Id: <199811030714.SAA08483@henry.cs.adfa.oz.au> Subject: Re: hidden files question To: jdn@acp.qiv.com (Jay Nelson) Date: Tue, 3 Nov 1998 18:14:04 +1100 (EST) Cc: security@FreeBSD.ORG In-Reply-To: from Jay Nelson at "Nov 2, 98 10:56:24 pm" Reply-To: wkt@cs.adfa.oz.au X-Mailer: ELM [version 2.4ME+ PL22 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In article by Jay Nelson: > that have failed. Today, /var was showing 50 MB and I could only > account for about 5MB. I could find no hidden files. > Any combination I've used with find hasn't shown anything. Any ideas > on how I can find the missing 45MB? > Is there a known benign condition that could account for this? If a process holds a file open, and you remove the file, then the directory entry is removed, but the file's inode and its contents still take space on the disk. You have to convince whichever process to close the file. Alternatively, you have to kill off the process, or shut the system down (at worst). Cheers, Warren To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message