How to clear an improperly unreferenced file in multi-user mode?

Olaf Greve o.greve at
Thu Nov 3 13:00:43 GMT 2005


When doing some maintenance on my fall-back server I ran into something 
weird. When running df it turned out /var was for 90% full. I then 
manually deleted some files (as root over SSH), amongst which the 
'maillog' logfiles in /var/log, I also killed sendmail (as it was 
generating the big log files, and at present I don't need to run it on 
that machine), and just to be sure I created a new 'maillog file of 0 

So far so good, but after removing the maillog files and performing 
another df call, the available size had not quite dropped as much as 
expected and as should. DU reports the proper amount of disk usage, so I 
performed an fsck.

On /var it shows:

239511 files, 2365547 used, 4942027 free (37155 frags, 613109 blocks, 
0.5% fragmentation)
** /dev/da0s1d (NO WRITE)
** Last Mounted on /var
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check Reference Counts
UNREF FILE I=48134  OWNER=root MODE=100640
SIZE=322792549 MTIME=Nov  3 13:46 2005

Now, of course one way to get rid of that big sucker is to boot the 
machine in single user mode and run fsck again, however, the box is 
nowhere near me and I cannot go down to the city where the machine is 
anytime soon (besides: this is far from an urgent issue). So, I was 
wondering about a thing: rather than doing a remote reboot and hope that 
fsck will clear it up in the booting process (if it does that at all, 
that is), I was wondering if there's a way to fix this when running in 
multi user mode.

Does anyone know how (if possible) to achieve this, or do I have to 
reboot the machine in single user mode after all?

Tnx and cheers,

PS: Will it perhaps be possible to manually unmount /var, then fsck -y 
it, and then remount it, or will that cause the machine to lock me out 
(or perform other undesired behaviour)?

More information about the freebsd-questions mailing list