HELP: some process eat my /var

[Lowell Gilbert]

Eugen Konkov <kes-kes at yandex.ru> writes:

> Здравствуйте, Vincent.
>
> Вы писали 5 ноября 2012 г., 12:38:47:
>>>
> VH> Its possible that a process is holding open an unlinked file (some
> VH> processes do this for tmp files as they are automatically deleted if the
> VH> program exit, I believe mysql does it for tmp tables for example)
> VH> I've had this happen when a log got rotated but the process wasnt
> VH> notified so it kept writing to the file.
> VH> I believe lsof +L1  will show unlinked but open files.
>
> it shows nothing ((

Not surprising; I think you had already covered that possibility with
fstat(1). It's vaguely possible that the space is used in large files
that are "covered" by the dev filesystem mounted in named's chroot, but
I think it's more likely you have some filesystem corruption.

Have you tried an fsck(8)? As usual, you would want good backups first,
and then rebooting to single-user mode so you can fsck the filesystem
without it being mounted.

Good luck.