How to clear an improperly unreferenced file in multi-user mode?
Alex de Kruijff
freebsd at akruijff.dds.nl
Sat Nov 5 10:59:53 GMT 2005
On Thu, Nov 03, 2005 at 02:00:25PM +0100, Olaf Greve wrote:
> When doing some maintenance on my fall-back server I ran into something
> weird. When running df it turned out /var was for 90% full. I then
> manually deleted some files (as root over SSH), amongst which the
> 'maillog' logfiles in /var/log, I also killed sendmail (as it was
> generating the big log files, and at present I don't need to run it on
> that machine), and just to be sure I created a new 'maillog file of 0
You could use /etc/newsyslog.conf to solve the big log file problem.
> So far so good, but after removing the maillog files and performing
> another df call, the available size had not quite dropped as much as
> expected and as should. DU reports the proper amount of disk usage, so I
> performed an fsck.
> On /var it shows:
> 239511 files, 2365547 used, 4942027 free (37155 frags, 613109 blocks,
> 0.5% fragmentation)
> ** /dev/da0s1d (NO WRITE)
> ** Last Mounted on /var
> ** Phase 1 - Check Blocks and Sizes
> ** Phase 2 - Check Pathnames
> ** Phase 3 - Check Connectivity
> ** Phase 4 - Check Reference Counts
> UNREF FILE I=48134 OWNER=root MODE=100640
> SIZE=322792549 MTIME=Nov 3 13:46 2005
> CLEAR? no
> Now, of course one way to get rid of that big sucker is to boot the
> machine in single user mode and run fsck again, however, the box is
> nowhere near me and I cannot go down to the city where the machine is
> anytime soon (besides: this is far from an urgent issue). So, I was
> wondering about a thing: rather than doing a remote reboot and hope that
> fsck will clear it up in the booting process (if it does that at all,
> that is), I was wondering if there's a way to fix this when running in
> multi user mode.
> Does anyone know how (if possible) to achieve this, or do I have to
> reboot the machine in single user mode after all?
I've done it in the past. First kill as much programms that use /var.
Then umount /var and let fsck have a go at it. This may result in some
core dumps. Then reboot.
> PS: Will it perhaps be possible to manually unmount /var, then fsck -y
> it, and then remount it, or will that cause the machine to lock me out
> (or perform other undesired behaviour)?
I don't beleave it will lock you out. It may not let you login again do.
It would be a good idea to have fysical access so you can press
Please copy the original recipients, otherwise I may not read your reply.
Howto's based on my ppersonal use, including information about
setting up a firewall and creating traffic graphs with MRTG
More information about the freebsd-questions