From owner-freebsd-questions@FreeBSD.ORG Sat Sep 20 02:40:23 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E265716A4B3 for ; Sat, 20 Sep 2003 02:40:23 -0700 (PDT) Received: from dire.bris.ac.uk (dire.bris.ac.uk [137.222.10.60]) by mx1.FreeBSD.org (Postfix) with ESMTP id DAFCD44001 for ; Sat, 20 Sep 2003 02:40:22 -0700 (PDT) (envelope-from Jan.Grant@bristol.ac.uk) Received: from mail.ilrt.bris.ac.uk by dire.bris.ac.uk with SMTP-PRIV with ESMTP; Sat, 20 Sep 2003 10:40:16 +0100 Received: from cmjg (helo=localhost) by mail.ilrt.bris.ac.uk with local-esmtp (Exim 3.16 #1) id 1A0eBF-00022F-00; Sat, 20 Sep 2003 10:37:29 +0100 Date: Sat, 20 Sep 2003 10:37:29 +0100 (BST) From: Jan Grant X-X-Sender: cmjg@mail.ilrt.bris.ac.uk To: Doug Hardie In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: Jan Grant cc: FreeBSD Questions Subject: Re: File deletion problem X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Sep 2003 09:40:24 -0000 On Fri, 19 Sep 2003, Doug Hardie wrote: > I have a situation that I have not been able to track down where on one > of my servers some process is writing a log file (I presume) and it is > getting rotated out from under it. The net result is that the log > continues to be written to the original file which eventually is > deleted thus leaving no trace of who or what. It takes several months > before its size becomes noticable, but eventually get grows to consume > remaining disk space. Given that the file has an inode but no > directory entry, how do you find it? All I have been able to come up > with is to use fstat to find all the open files inodes and then to > search with ls for each by hand and removing those I can find. > Unfortunately this is a large web server with lots of files. > > Today I moved some of the log files onto a different disk to see if the > problem moves. That would narrow down the search considerably. But I > suspect I will have to wait a couple months before I can see the > effects of the hidden file. Ideally, install lsof. Or you might try: http://ioctl.org/unix/scripts/openfiles ...which does what you're after. -- jan grant, ILRT, University of Bristol. http://www.ilrt.bris.ac.uk/ Tel +44(0)117 9287088 Fax +44 (0)117 9287112 http://ioctl.org/jan/ Generalisation is never appropriate.