File system b0rked.

[Peter Jeremy]

On Sun, Jan 11, 2004 at 12:10:12AM +0100, Martin Jessa wrote:
>Something is totally b0rken. My file system was filled up by a far
>too big log file. I deleted it and waited half an hour for system to
>"settle down". This is what it still showed:
>
>
>[root at urukhai:/var/log]# du -hs /var/
>471M    /var/
>
>
>[root at urukhai:/var/log]# df -h |grep var
>/dev/ad0s1g                    1.9G   1.8G  -1.5M   100%    /var

Files in Unix don't have to have names.  It is possible to delete
an open file and the filename will go away but the file will remain
(still occupying space) until it is closed.

The easiest way to identify the process would be to run "lsof /var"
and look for an entry without a filename.  You then need to either
kill the process or send it whichever signal it needs to tell it to
switch to a new logfile.  (If you don't have lsof installed, it may
be possible to identify the process from the filename - it's most
likely to be syslogd).

Peter