Re: [List] Cannot find out what uses space in ZFS dataset

On 9/21/25 23:21, David Christensen wrote:

> Have you done a scrub recently?

The pool was last scubbed by periodic a month ago.
I've launched a new scrub manually now, but I guess it won't do much, 
given the problem arised long ago.



> I had the idea to use diff(1) to compare the snapshots when the size 
> jumped, but did not post it because if du(1) cannot see problem file(s) 
> then diff(1) should not:
> 
> # diff -r /.zfs/snapshot/auto_zroot-20250611020000 /.zfs/snapshot/ 
> auto_zroot-20250711020000

Didn't try, but tried a find on /.zfs/snapshot/ and the file doesn't 
come up.



> An improved idea that might work would be to use zfs-diff(8) to compare 
> the snapshots.  Consider adding option "-H" and redirecting the output 
> to a file for further analysis, issue tracking, etc.:
> 
> # zfs diff @auto_zroot-20250611020000 zroot/ROOT/ 
> default@auto_zroot-20250711020000

I already deleted those snapshots, remember?

I wonder if deleting all the others would solve...



> Perhaps booting into single user mode, doing a scrub, and investigating/ 
> trouble-shooting?

I'll be able to put my hands on the box in 1-2 weeks and I was already 
thinking about trying single user mode.
A scrub in SU, however, is out of the question, as it would take several 
hours and this is a production server.



> Do you have a saved zfs-send(8) backup stream or raw disk image from 
> prior to the issue that you can restore?

Probably not: it would be a very old version of the system and it would 
be more trouble than now.



> If all else fails, backup/ wipe/ install/ restore the OS disk.  I prefer 
> the oldest supported version of an OS (e.g. FreeBSD-13.5-RELEASE), as it 
> should have fewer bugs than newer versions of an OS.

Again, this is a production server, so this is close to impossible.
The problem is not that severe right now: the most disturbing thing is 
that I cannot do a "dump" and send it over the Internet, because it 
would be too big for a slow line.

Eventually I was thinking about creating a different ROOT dataset, 
rsyncyng everything to it and switching to it (although I'd be curious 
to sort this out, i.e. find a solution, not a workaround).



I'm also planning the upgrade from 14.2 to 14.3... who knows if it could 
help?



  bye & Thanks
	av.