From owner-freebsd-questions Thu Dec 21 6:53: 0 2000 From owner-freebsd-questions@FreeBSD.ORG Thu Dec 21 06:52:57 2000 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from gateway.telecom.ksu.edu (gateway-1.telecom.ksu.edu [129.130.63.239]) by hub.freebsd.org (Postfix) with ESMTP id 49BB237B400 for ; Thu, 21 Dec 2000 06:52:57 -0800 (PST) Received: from sioux.telecom.ksu.edu(129.130.60.32) by pawnee.telecom.ksu.edu via smap (V2.0) id xma014728; Thu, 21 Dec 00 08:52:23 -0600 Sender: nathan@telecom.ksu.edu Message-ID: <3A4218E7.40A8F22F@telecom.ksu.edu> Date: Thu, 21 Dec 2000 08:51:19 -0600 From: nathan X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.12 i386) X-Accept-Language: en MIME-Version: 1.0 To: mysql-freebsd Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Weird /var behavior or was I hacked? References: <3.0.6.32.20001221094434.00963ad0@lh1.rdc2.pa.home.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG for more accurate results, try something like this du -k /var that will give you sizes for all files/dirs in/under /var and the total disk usage for /var man du for more info this will at least tell you WHERE the disk space is being hogged, and you can start tracing from there nathan mysql-freebsd wrote: > Hi: > > I found some pretty weird thing that i can't explain or solve so > I count on your help. > > I recently noticed growth in the size of occupied space on /var. > Here is output from "df" > > Filesystem 1K-blocks Used Avail Capacity Mounted on > <...> > /dev/da0s1h 1034159 766564 184863 81% /var > <...> > > In other words, out of about 1 GB partition 767 MB are filled. > On the other hand, I calculated total sum of all the files > in /var using two independent methods (ran ls -laR amd calculated > sum of sizes and tar'ed the whole patition and looked at the size > of the tar file). Both methods show that the sum of the > sizes of all the files in the partition comes to only 14 MB. > > There is this huge difference between 767 MB reported occupied by df > and 14 MB of the sum of all teh files. Looks as if somebody got > in, made an invisible partition within /var. > > Am I paranoid or missing something? Or both? > > Thanks for your help, > A.H. > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message