From owner-freebsd-fs@FreeBSD.ORG Wed Oct 17 11:56:20 2007 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2BE7816A41B for ; Wed, 17 Oct 2007 11:56:20 +0000 (UTC) (envelope-from anderson@freebsd.org) Received: from ns.trinitel.com (186.161.36.72.static.reverse.ltdomains.com [72.36.161.186]) by mx1.freebsd.org (Postfix) with ESMTP id E6F9A13C468 for ; Wed, 17 Oct 2007 11:56:19 +0000 (UTC) (envelope-from anderson@freebsd.org) Received: from proton.storspeed.com (209-163-168-124.static.twtelecom.net [209.163.168.124]) (authenticated bits=0) by ns.trinitel.com (8.14.1/8.14.1) with ESMTP id l9HBuIqS072294; Wed, 17 Oct 2007 06:56:19 -0500 (CDT) (envelope-from anderson@freebsd.org) Message-ID: <4715F859.9060102@freebsd.org> Date: Wed, 17 Oct 2007 06:56:09 -0500 From: Eric Anderson User-Agent: Thunderbird 2.0.0.6 (Macintosh/20070728) MIME-Version: 1.0 To: Paul Kupfer References: <20071016114035.O64828@lorax.ldc.upenn.edu> In-Reply-To: <20071016114035.O64828@lorax.ldc.upenn.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-2.0 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.1.8 X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on ns.trinitel.com Cc: freebsd-fs@freebsd.org Subject: Re: du and df discrepancy X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Oct 2007 11:56:20 -0000 Paul Kupfer wrote: > > I am seeing a very odd problem on a FreeBSD 6.1-PRERELEASE #0 mail > server we have. We originally had a separate scsi device mounted as > /var/mail (note this was underneath the mountpoint for /var). We > reached a point where space on /var was running out, and running a df on > that volume would show that there was only 160M out of 5.8G available > (and 5.2G used). > > So I ran "du -hc /var" to see where I could remove some old files. du > output shows the total of /var to be 311M, which is vastly different > than what du tells me. I thought that this was perhaps a result of the > way we had things mounted, and so I unmount the /var/mail device and > remounted it as /mail, then put a symlink from /mail to /var/mail, still > no dice, same results. > > I have not rebooted the machine yet (was hoping I wouldn't have to > since it is a mail server). Is it possible that the inode tables are > "out of whack" since changing these mountpoints, perhaps an fsck? > Anyone ever seen anything like this before? > > Any help would be greatly appreciated. My guess is that you run apache, and the log file got huge, rotated out, but apache still has it open. You could install lsof possibly and see what files it has open, and it will show you their size also. Restarting apache should also clear it. Eric