From owner-freebsd-current@FreeBSD.ORG Sat Jan 10 15:39:37 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B94E416A4CE for ; Sat, 10 Jan 2004 15:39:37 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6072043D2F for ; Sat, 10 Jan 2004 15:39:36 -0800 (PST) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (localhost [127.0.0.1]) by fledge.watson.org (8.12.10/8.12.10) with ESMTP id i0ANc4Ud002143; Sat, 10 Jan 2004 18:38:04 -0500 (EST) (envelope-from robert@fledge.watson.org) Received: from localhost (robert@localhost)i0ANc48o002140; Sat, 10 Jan 2004 18:38:04 -0500 (EST) (envelope-from robert@fledge.watson.org) Date: Sat, 10 Jan 2004 18:38:04 -0500 (EST) From: Robert Watson X-Sender: robert@fledge.watson.org To: Martin Jessa In-Reply-To: <20040111001012.7ea22a1e.freebsd@yazzy.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-current@freebsd.org Subject: Re: File system b0rked. X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Jan 2004 23:39:37 -0000 On Sun, 11 Jan 2004, Martin Jessa wrote: > Something is totally b0rken. My file system was filled up by a far too > big log file. I deleted it and waited half an hour for system to "settle > down". This is what it still showed: > > [root@urukhai:/var/log]# du -hs /var/ > 471M /var/ > > [root@urukhai:/var/log]# df -h |grep var > /dev/ad0s1g 1.9G 1.8G -1.5M 100% /var > > root@urukhai:/var/log]# uname -a > FreeBSD urukhai.yazzy.org 5.2-RC FreeBSD 5.2-RC #1: Thu Jan 8 19:16:56 CET 2004 root@urukhai.yazzy.org:/usr/obj/usr/src/sys/URUKHAI i386 Three possibilities come to mind: (1) Is the file still held open by syslogd, in which case the space can't be recovered until syslogd closes it? Restart syslogd. (2) Do you have any file system snapshots -- in particular, check for a .fsck_snapshot in the root directory of your file system, or for other stuff in .snap/ in the root directory of your file system. Because snapshots are copy-on-write, perceived "free space" remains the same as you delete files, since the space owned by the file moves from the file to the snapshot. (3) Is background fsck running? If so, it may have a snapshot open on the file system. Try killing fsck and see if the space comes back (note you'll want to run fsck again sometime). Robert N M Watson FreeBSD Core Team, TrustedBSD Projects robert@fledge.watson.org Senior Research Scientist, McAfee Research