From owner-freebsd-questions  Thu Dec 21  6:44:37 2000
From owner-freebsd-questions@FreeBSD.ORG  Thu Dec 21 06:44:35 2000
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mail.rdc2.pa.home.com (ha2.rdc2.pa.home.com [24.12.106.195])
	by hub.freebsd.org (Postfix) with ESMTP id 81AE137B400
	for <freebsd-questions@FreeBSD.ORG>; Thu, 21 Dec 2000 06:44:35 -0800 (PST)
Received: from nightflight ([24.8.217.56]) by mail.rdc2.pa.home.com
          (InterMail vM.4.01.03.00 201-229-121) with SMTP
          id <20001221144434.XMMD9109.mail.rdc2.pa.home.com@nightflight>
          for <freebsd-questions@FreeBSD.ORG>;
          Thu, 21 Dec 2000 06:44:34 -0800
Message-Id: <3.0.6.32.20001221094434.00963ad0@lh1.rdc2.pa.home.com>
X-Sender: mysql-freebsd@lh1.rdc2.pa.home.com (Unverified)
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.6 (32)
Date: Thu, 21 Dec 2000 09:44:34 -0500
To: freebsd-questions@FreeBSD.ORG
From: mysql-freebsd <mysql-freebsd@home.com>
Subject: Weird /var behavior or was I hacked?
In-Reply-To: <MPBBLJLABKFCLAHJNBNGIEFHIBAA.wabit@adl.ussr.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Hi:

I found some pretty weird thing that i can't explain or solve so 
I count on your help.

I recently noticed growth in the size of occupied space on /var.
Here is output from "df"

Filesystem  1K-blocks     Used    Avail Capacity  Mounted on
<...>
/dev/da0s1h   1034159   766564   184863    81%    /var
<...>

In other words, out of about 1 GB partition 767 MB are filled.
On the other hand, I calculated total sum of all the files
in /var using two independent methods (ran ls -laR amd calculated
sum of sizes and tar'ed the whole patition and looked at the size 
of the tar file). Both methods show that the sum of the 
sizes of all the files in the partition comes to only 14 MB.

There is this huge difference between 767 MB reported occupied by df
and 14 MB of the sum of all teh files. Looks as if somebody got
in, made an invisible partition within /var.

Am I paranoid or missing something? Or both?

Thanks for your help,
A.H.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message