Re: [List] Cannot find out what uses space in ZFS dataset

From: <freebsd_at_vanderzwan.org>
Date: Mon, 22 Sep 2025 05:15:56 UTC

> On 22 Sep 2025, at 07:12, freebsd@vanderzwan.org wrote:
> 
> 

You need zdb with 5 d’s to get the name. So 'zdb -ddddd zroot/ROOT/default  360’

Cheers
 Paul

> 
>> On 21 Sep 2025, at 19:07, Andrea Venturoli <ml@netfence.it> wrote:
>> 
>> On 9/19/25 15:28, freebsd@vanderzwan.org wrote:
>> 
>>> Maybe procstat -af and look for a regular file with a huge value in OFFSET column. That assumes the file offset is at EOF for that huge file.
>> 
>> Didn't help.
>> 
>> I finally had the chance to reboot, but not even this solved!!! :(
>> 
> 
> So we know it’s not a deleted but open file. That means it must have a name…
> 
>> I still get the same figures:
>>> # du -d 0 -h -x
>>> 3.3G    .
>>> # zdb -ddd zroot/ROOT/default 0:-1:A |sort -h -b -k 5 |tail
>>>   186544    2   128K   128K  31.3M     512  57.5M  100.00  ZFS plain file
>>>     5738    2   128K   128K  33.2M     512  51.9M  100.00  ZFS plain file
>>>        0    6   128K    16K  39.5M     512   176M   29.37  DMU dnode
>>>   186545    2   128K   128K  48.4M     512  93.5M   99.60  ZFS plain file
>>>   186426    2   128K   128K  53.1M     512   101M  100.00  ZFS plain file
>>>   186668    3   128K   128K  76.2M     512   178M  100.00  ZFS plain file
>>>   186209    3   128K   128K  91.9M     512   253M  100.00  ZFS plain file
>>>   186671    3   128K   128K   135M     512   327M  100.00  ZFS plain file
>>>   186427    3   128K   128K   140M     512   334M  100.00  ZFS plain file
>>>      360    3   128K   128K  58.8G     512  90.0G  100.00  ZFS plain file
>> 
>> 
> 
> Can you try ‘zdb -dddd zroot/ROOT/default  360’ ?
> ( so 4 d’s )
> 
> If I try that on a normal file in my homedir it gives me the ’stat’ information, and even the filename.
> Even if it does not give a name the owner/group and the timestamps might give a hint where to find it.
> It will also give a list of the indirect blocks which will be huge but the interresting output should be at the start.
> 
> Cheers,
> 	Paul