From owner-freebsd-questions@FreeBSD.ORG Tue May 4 17:09:54 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 57EB716A4CE for ; Tue, 4 May 2004 17:09:54 -0700 (PDT) Received: from av11-2-sn4.m-sp.skanova.net (av11-2-sn4.m-sp.skanova.net [81.228.10.105]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3D54843D41 for ; Tue, 4 May 2004 17:09:53 -0700 (PDT) (envelope-from ertr1013@student.uu.se) Received: by av11-2-sn4.m-sp.skanova.net (Postfix, from userid 502) id 29EFB37E44; Wed, 5 May 2004 02:09:52 +0200 (CEST) Received: from smtp4-1-sn4.m-sp.skanova.net (smtp4-1-sn4.m-sp.skanova.net [81.228.10.181]) by av11-2-sn4.m-sp.skanova.net (Postfix) with ESMTP id 17DD137E43 for ; Wed, 5 May 2004 02:09:52 +0200 (CEST) Received: from falcon.midgard.homeip.net (h201n1fls24o1048.bredband.comhem.se [212.181.162.201]) by smtp4-1-sn4.m-sp.skanova.net (Postfix) with SMTP id B8BAD37E43 for ; Wed, 5 May 2004 02:09:51 +0200 (CEST) Received: (qmail 56927 invoked by uid 1001); 5 May 2004 00:09:50 -0000 Date: Wed, 5 May 2004 02:09:50 +0200 From: Erik Trulsson To: Michael Conlen Message-ID: <20040505000950.GA56915@falcon.midgard.homeip.net> Mail-Followup-To: Michael Conlen , freebsd-questions@freebsd.org References: <527A4BE3-9E1D-11D8-BD41-00039367611E@obfuscated.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <527A4BE3-9E1D-11D8-BD41-00039367611E@obfuscated.net> User-Agent: Mutt/1.5.6i cc: freebsd-questions@freebsd.org Subject: Re: Disk Usage X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 May 2004 00:09:54 -0000 On Tue, May 04, 2004 at 06:49:38PM -0400, Michael Conlen wrote: > I have a NFS server running FreeBSD-4.9-RELEASE. It's run fine for > several months with five FreeBSD 4.9 systems mounting it's filesystems. > Suddenly something started using disk space at the rate of 10 GB/hour > on one of the filesystems (which has exported directories). The catch > is that a du -k shows a total usage for that file system of much less > than df -k. du -k essentially shows the disk usage before the available > space started to disappear! Normally I'd presume someone's hiding files > under a mount point when I see this but nothings mounted on a directory > in this filesystem. Upon reboot the space is not used anymore, df -k > and du -k report similar values. > > Quite simply odd. Some other details... ...this has happened twice in > one day, and the rate of "ghost" disk usage is constant and identical > in both graphs. The file server is used to serve files to clustered web > servers. There's considerable write activity to the NFS server all the > time (40-60Mbit/sec) and moderate read access (~10Mbit/sec). > > Any ideas what would cause the df -k and du -k discrepancy? That sounds like some program keeps one or more files open and writes to it while the directory entry for the file has been removed. (Probably some log file which is kept open, but it might be something else.) Space used by a file is not marked as free until all directory entries referring to the file has been removed AND no program has the file open. This is the normal cause for df/du discrepancies that you describe. -- Erik Trulsson ertr1013@student.uu.se