free space reported incorrectly

[Colin Farley]

Thanks for the reply.  I have found as suspected that apache is
responsible.  Since these servers are redundant using UCARP I am planning
to shut down the services, unmount /var and run fsck, one at a time.  I'm
just not sure why I cannot see these files but hopefully fsck will make
them visable or just remove them for me.  I think at the same time I will
make a change to my apache log rotation strategy as it appears to be
causing the problems.

Thanks again,
Colin



                                                                           
             Dan Nelson                                                    
             <dnelson at allantgr                                             
             oup.com>                                                   To 
                                       Colin Farley                        
             12/14/2005 10:35          <Colin.Farley at ecarecenters.com>     
             AM                                                         cc 
                                       freebsd-stable at freebsd.org          
                                                                   Subject 
                                       Re: free space reported incorrectly 
                                                                           
                                                                           
                                                                           
                                                                           
                                                                           
                                                                           




In the last episode (Dec 14), Colin Farley said:
> I'm running FreeBSD 4.10-RELEASE-p16 on a couple of production mail
> relays/web servers.  Today I noticed that one had a lot more space in
> /var used.  I figured that a log was growing and started to
> investigate.  After running du -h /var and seeing it come up with a
> total usage much less than what df -h reports I decided to run fsck
> /var.  This is the output I get:
>
> ** /dev/da1s1f (NO WRITE)

Don't trust any fsck output on a mounted filessytem.

You probably have some logfiles that got manually rotated or deleted
(i.e. not via newsyslog), and syslogd was never told to close&reopen
the logfile.  Run "lsof +L1" (lsof is in ports) to find the offending
processes and restart them.

--
 Dan Nelson
 dnelson at allantgroup.com