df command reports wrong value after fd have been released

[Lowell Gilbert]

Bastien Semene <bsemene at cyanide-studio.com> writes:

> I removed a file from /var using all my filesystem space, then restarted 
> the process that handled its file descriptors.
> I then, for another reason, had to reboot the system.
>
> During the boot I had a warning saying that the filesystem is full.
>
> I did not checked the fs state with df before, thinking it was resolved.
> df now still shows me the fs is full, I stopped the process then checked 
> the fd with lsof, they were removed.
> I changed the log file name then restarted the process.
> lsof shows me that the process no longer uses fd on this "ghost" file.
>
> I'm out of ideas to resolve the problem, as I'm out of knowledge to 
> understand it.
> Any explanation/idea to resolve this issue is welcome.
>
> some informations :
> # uname -a
> FreeBSD vcs.cyanide-studio.com 8.2-RELEASE-p3 FreeBSD 8.2-RELEASE-p3 #0: 
> Tue Sep 27 18:45:57 UTC 2011     
> root at amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64
>

Are you sure there isn't some other file on /var using up the space? The
file you already deleted might not be the culprit. 

It also might be useful to fsck the filesystem and to mount it without
the database ("tank," you called it) filesystem on top of it, to make
sure there are no files shadowed there.