Mystery of increasing disk usage

[Bill Moran]

"Jamie Penman-Smithson" <jpenman.smithson at gmail.com> wrote:
>
> I'm having big problems trying to pin down the cause of spiralling
> disk usage on a partition.
> 
> du -sh shows that /usr is using 5.9 GB:
> $ du -shL /usr
> 5.9G    /usr
> 
> However, df shows:
> 
> Filesystem     Size    Used   Avail Capacity  Mounted on
> /dev/ad4s1f     47G     43G    131M   100%    /usr
> [...]
> 
> It seems to be eating 3 MB roughly every 4-5 minutes. However,
> repeated uses of du don't show any increased usage. It only appears in
> df.
> 
> defiant:/usr$ du -cksmxL * | sort -rn
> 6042    total
> 3015    home
> 965     obj
> 777     local
> 770     jail
> 376     share
> 36      lib
> 32      X11R6
> 28      bin
> 19      libexec
> 15      sbin
> 15      include
> 1       tmp
> 1       ports
> 1       openssl
> 1       libdata
> 1       games
> 1       compat
> 
> My first thought is that the du binary is compromised, but I thought
> that I may be missing something blindingly obvious.

If I remember correctly, the most common reason for this is files that
have been deleted, but have not had all references to them closed (i.e.
file descriptors).

For example, program creates a temporary file, then deletes it but does
not _close_ it.  This means the filesystem can't free up the used blocks
yet.  There's no directory entry, so du doesn't see the usage.

One way to tell would be to reboot the system.  If it comes up with
du and df agreeing, then this problem is occurring somewhere.  The
trickier step may be to figure out what program is causing it.

-- 
Bill Moran
http://www.potentialtech.com