From owner-freebsd-questions@FreeBSD.ORG Fri Aug 3 17:50:12 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C576A16A46B for ; Fri, 3 Aug 2007 17:50:12 +0000 (UTC) (envelope-from wmoran@potentialtech.com) Received: from mail.potentialtech.com (internet.potentialtech.com [66.167.251.6]) by mx1.freebsd.org (Postfix) with ESMTP id 9E10713C45A for ; Fri, 3 Aug 2007 17:50:12 +0000 (UTC) (envelope-from wmoran@potentialtech.com) Received: from working (c-71-60-127-199.hsd1.pa.comcast.net [71.60.127.199]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.potentialtech.com (Postfix) with ESMTP id 86409EBC78; Fri, 3 Aug 2007 13:50:11 -0400 (EDT) Date: Fri, 3 Aug 2007 13:50:10 -0400 From: Bill Moran To: jpenman.smithson@gmail.com Message-Id: <20070803135010.0c24e359.wmoran@potentialtech.com> In-Reply-To: <42acc2230708031016r726acd1em5d292c949c9d13d7@mail.gmail.com> References: <42acc2230708031016r726acd1em5d292c949c9d13d7@mail.gmail.com> X-Mailer: Sylpheed 2.4.3 (GTK+ 2.10.14; i386-portbld-freebsd6.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: Mystery of increasing disk usage X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Aug 2007 17:50:12 -0000 "Jamie Penman-Smithson" wrote: > > I'm having big problems trying to pin down the cause of spiralling > disk usage on a partition. > > du -sh shows that /usr is using 5.9 GB: > $ du -shL /usr > 5.9G /usr > > However, df shows: > > Filesystem Size Used Avail Capacity Mounted on > /dev/ad4s1f 47G 43G 131M 100% /usr > [...] > > It seems to be eating 3 MB roughly every 4-5 minutes. However, > repeated uses of du don't show any increased usage. It only appears in > df. > > defiant:/usr$ du -cksmxL * | sort -rn > 6042 total > 3015 home > 965 obj > 777 local > 770 jail > 376 share > 36 lib > 32 X11R6 > 28 bin > 19 libexec > 15 sbin > 15 include > 1 tmp > 1 ports > 1 openssl > 1 libdata > 1 games > 1 compat > > My first thought is that the du binary is compromised, but I thought > that I may be missing something blindingly obvious. If I remember correctly, the most common reason for this is files that have been deleted, but have not had all references to them closed (i.e. file descriptors). For example, program creates a temporary file, then deletes it but does not _close_ it. This means the filesystem can't free up the used blocks yet. There's no directory entry, so du doesn't see the usage. One way to tell would be to reboot the system. If it comes up with du and df agreeing, then this problem is occurring somewhere. The trickier step may be to figure out what program is causing it. -- Bill Moran http://www.potentialtech.com