How to check where space is LOST

[illoai at gmail.com]

2011/9/11 Коньков Евгений <kes-kes at yandex.ru>:
> Hi.
>
> I notice that some times /var is overfull
>
> # df -h
> Filesystem     Size    Used   Avail Capacity  Mounted on
> /dev/ad1s1a    496M    239M    217M    52%    /
> devfs          1.0K    1.0K      0B   100%    /dev
> /dev/ad1s1e    124M     40K    114M     0%    /tmp
> /dev/ad1s1f    1.8G    1.1G    596M    65%    /usr
> /dev/ad1s1d    989M    349M    561M    38%    /var
> devfs          1.0K    1.0K      0B   100%    /var/named/dev
>
> # cd /var/
>
> # du -h -d 1
> 2.0K    ./.snap
> 2.0K    ./account
> 6.0K    ./at
> 2.0K    ./audit
>  12K    ./backups
> 4.0K    ./crash
> 4.0K    ./cron
> 2.0K    ./empty
> 2.0K    ./heimdal
>  79M    ./log
>  19M    ./mail
> 4.0K    ./msgs
> 159K    ./named
> 2.0K    ./preserve
>  60K    ./run
> 2.0K    ./rwho
>  70K    ./spool
>  14K    ./tmp
>  24K    ./yp
> 2.0K    ./games
> 2.0K    ./agentx
>  22K    ./net-snmp
> 4.0K    ./lost+found
>  98M    .
>
> If I just #reboot system. I get that on /var is only 98M used.
>
> # df -h
> Filesystem     Size    Used   Avail Capacity  Mounted on
> /dev/ad1s1a    496M    239M    217M    52%    /
> devfs          1.0K    1.0K      0B   100%    /dev
> /dev/ad1s1e    124M     40K    114M     0%    /tmp
> /dev/ad1s1f    1.8G    1.1G    596M    65%    /usr
> /dev/ad1s1d    989M     98M    891M    12%    /var
> devfs          1.0K    1.0K      0B   100%    /var/named/dev
>
> How to obtain what take space on /var
>

You probably have a process that is holding a file open
that has been rotated or deleted.  Probably a log file.

sysutils/lsof can help.

Also, once you track down which
process is holding open files, you should try to find out
why (/etc/syslog.conf is a suspect, obviously).


-- 
--