From owner-freebsd-questions@FreeBSD.ORG Sat Nov 5 10:59:53 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6817C16A41F for ; Sat, 5 Nov 2005 10:59:53 +0000 (GMT) (envelope-from freebsd@akruijff.dds.nl) Received: from smtp18.wxs.nl (smtp18.wxs.nl [195.121.247.9]) by mx1.FreeBSD.org (Postfix) with ESMTP id E67B943D45 for ; Sat, 5 Nov 2005 10:59:52 +0000 (GMT) (envelope-from freebsd@akruijff.dds.nl) Received: from smtp.planet.nl (ip51cc8423.speed.planet.nl [81.204.132.35]) by smtp18.wxs.nl (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 2004)) with ESMTP id <0IPH00EIKAJR74@smtp18.wxs.nl> for freebsd-questions@freebsd.org; Sat, 05 Nov 2005 11:59:52 +0100 (CET) Received: from Alex.lan (localhost [127.0.0.1]) by smtp.planet.nl (8.13.3/8.13.3) with ESMTP id jA5AxpHW001169; Sat, 05 Nov 2005 11:59:51 +0100 Received: (from akruijff@localhost) by Alex.lan (8.13.3/8.13.3/Submit) id jA5Axoj6001168; Sat, 05 Nov 2005 11:59:50 +0100 Content-return: prohibited Date: Sat, 05 Nov 2005 11:59:50 +0100 From: Alex de Kruijff In-reply-to: <436A09E9.5070905@axis.nl> To: Olaf Greve Message-id: <20051105105950.GB837@Alex.lan> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline User-Agent: Mutt/1.4.2.1i References: <436A09E9.5070905@axis.nl> X-Authentication-warning: Alex.lan: akruijff set sender to freebsd@akruijff.dds.nl using -f Cc: freebsd-questions@freebsd.org Subject: Re: How to clear an improperly unreferenced file in multi-user mode? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: freebsd@akruijff.dds.nl List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Nov 2005 10:59:53 -0000 On Thu, Nov 03, 2005 at 02:00:25PM +0100, Olaf Greve wrote: > Hi, > > When doing some maintenance on my fall-back server I ran into something > weird. When running df it turned out /var was for 90% full. I then > manually deleted some files (as root over SSH), amongst which the > 'maillog' logfiles in /var/log, I also killed sendmail (as it was > generating the big log files, and at present I don't need to run it on > that machine), and just to be sure I created a new 'maillog file of 0 > length. You could use /etc/newsyslog.conf to solve the big log file problem. > So far so good, but after removing the maillog files and performing > another df call, the available size had not quite dropped as much as > expected and as should. DU reports the proper amount of disk usage, so I > performed an fsck. > > On /var it shows: > > 239511 files, 2365547 used, 4942027 free (37155 frags, 613109 blocks, > 0.5% fragmentation) > ** /dev/da0s1d (NO WRITE) > ** Last Mounted on /var > ** Phase 1 - Check Blocks and Sizes > ** Phase 2 - Check Pathnames > ** Phase 3 - Check Connectivity > ** Phase 4 - Check Reference Counts > UNREF FILE I=48134 OWNER=root MODE=100640 > SIZE=322792549 MTIME=Nov 3 13:46 2005 > CLEAR? no > > > Now, of course one way to get rid of that big sucker is to boot the > machine in single user mode and run fsck again, however, the box is > nowhere near me and I cannot go down to the city where the machine is > anytime soon (besides: this is far from an urgent issue). So, I was > wondering about a thing: rather than doing a remote reboot and hope that > fsck will clear it up in the booting process (if it does that at all, > that is), I was wondering if there's a way to fix this when running in > multi user mode. > > Does anyone know how (if possible) to achieve this, or do I have to > reboot the machine in single user mode after all? I've done it in the past. First kill as much programms that use /var. Then umount /var and let fsck have a go at it. This may result in some core dumps. Then reboot. > > PS: Will it perhaps be possible to manually unmount /var, then fsck -y > it, and then remount it, or will that cause the machine to lock me out > (or perform other undesired behaviour)? I don't beleave it will lock you out. It may not let you login again do. It would be a good idea to have fysical access so you can press cntr-alt-delete -- Alex Please copy the original recipients, otherwise I may not read your reply. Howto's based on my ppersonal use, including information about setting up a firewall and creating traffic graphs with MRTG http://www.kruijff.org/alex/FreeBSD/