How to clear an improperly unreferenced file in multi-user mode?

[Alex de Kruijff]

On Thu, Nov 03, 2005 at 02:00:25PM +0100, Olaf Greve wrote:
> Hi,
> 
> When doing some maintenance on my fall-back server I ran into something 
> weird. When running df it turned out /var was for 90% full. I then 
> manually deleted some files (as root over SSH), amongst which the 
> 'maillog' logfiles in /var/log, I also killed sendmail (as it was 
> generating the big log files, and at present I don't need to run it on 
> that machine), and just to be sure I created a new 'maillog file of 0 
> length.

You could use /etc/newsyslog.conf to solve the big log file problem.

> So far so good, but after removing the maillog files and performing 
> another df call, the available size had not quite dropped as much as 
> expected and as should. DU reports the proper amount of disk usage, so I 
> performed an fsck.
> 
> On /var it shows:
> 
> 239511 files, 2365547 used, 4942027 free (37155 frags, 613109 blocks, 
> 0.5% fragmentation)
> ** /dev/da0s1d (NO WRITE)
> ** Last Mounted on /var
> ** Phase 1 - Check Blocks and Sizes
> ** Phase 2 - Check Pathnames
> ** Phase 3 - Check Connectivity
> ** Phase 4 - Check Reference Counts
> UNREF FILE I=48134  OWNER=root MODE=100640
> SIZE=322792549 MTIME=Nov  3 13:46 2005
> CLEAR? no
> 
> 
> Now, of course one way to get rid of that big sucker is to boot the 
> machine in single user mode and run fsck again, however, the box is 
> nowhere near me and I cannot go down to the city where the machine is 
> anytime soon (besides: this is far from an urgent issue). So, I was 
> wondering about a thing: rather than doing a remote reboot and hope that 
> fsck will clear it up in the booting process (if it does that at all, 
> that is), I was wondering if there's a way to fix this when running in 
> multi user mode.
> 
> Does anyone know how (if possible) to achieve this, or do I have to 
> reboot the machine in single user mode after all?

I've done it in the past. First kill as much programms that use /var.
Then umount /var and let fsck have a go at it. This may result in some
core dumps. Then reboot.
> 
> PS: Will it perhaps be possible to manually unmount /var, then fsck -y 
> it, and then remount it, or will that cause the machine to lock me out 
> (or perform other undesired behaviour)?

I don't beleave it will lock you out. It may not let you login again do.
It would be a good idea to have fysical access so you can press
cntr-alt-delete

-- 
Alex

Please copy the original recipients, otherwise I may not read your reply.

Howto's based on my ppersonal use, including information about 
setting up a firewall and creating traffic graphs with MRTG
http://www.kruijff.org/alex/FreeBSD/