File system b0rked.

[Robert Watson]

On Sun, 11 Jan 2004, Martin Jessa wrote:

> Something is totally b0rken. My file system was filled up by a far too
> big log file. I deleted it and waited half an hour for system to "settle
> down". This is what it still showed: 
> 
> [root at urukhai:/var/log]# du -hs /var/
> 471M    /var/
> 
> [root at urukhai:/var/log]# df -h |grep var
> /dev/ad0s1g                    1.9G   1.8G  -1.5M   100%    /var
> 
> root at urukhai:/var/log]# uname -a
> FreeBSD urukhai.yazzy.org 5.2-RC FreeBSD 5.2-RC #1: Thu Jan  8 19:16:56 CET 2004     root at urukhai.yazzy.org:/usr/obj/usr/src/sys/URUKHAI  i386

Three possibilities come to mind:

(1) Is the file still held open by syslogd, in which case the space can't
    be recovered until syslogd closes it?  Restart syslogd.

(2) Do you have any file system snapshots -- in particular, check for a
    .fsck_snapshot in the root directory of your file system, or for other
    stuff in .snap/ in the root directory of your file system.  Because
    snapshots are copy-on-write, perceived "free space" remains the same
    as you delete files, since the space owned by the file moves from the
    file to the snapshot.

(3) Is background fsck running?  If so, it may have a snapshot open on the
    file system.  Try killing fsck and see if the space comes back (note
    you'll want to run fsck again sometime). 

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert at fledge.watson.org      Senior Research Scientist, McAfee Research