[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: / is suddenly 100% used

>>>>> "kmself" == kmself  <kmself@ix.netcom.com> writes:

    kmself> Not strictly.  You can track things down through lsof or
    kmself> the /proc filesystem, but it's hard to work out what files
    kmself> are then accounting for large amounts of disk utilization.
    kmself> In other words -- it's a hell of a lot easier to deal with
    kmself> a file if you've got a file to deal with, rather than just
    kmself> a filehandle (lsof).

In this case I would start of with "fuser -mv /partition", as I get
the general impression that no files on the partition should be in
use, as the it is "almost empty".

Once I found a suspicious process, I would do "ls -l /proc/$pid/fd"
replacing $pid with the process id to find the name of the file.

As an example with Linux 2.4.2:

[515] [snoopy:bam] ~ >fuser -mv /old/home/bam

                     USER        PID ACCESS COMMAND
/old/home/bam        bam       30621 f....  zsh
                     bam       30626 f....  sleep

[516] [snoopy:bam] ~ >ls -l /proc/30621/fd   
total 0
lrwx------    1 bam      bam            64 Mar  4 09:22 0 -> /dev/pts/1
l-wx------    1 bam      bam            64 Mar  4 09:22 1 -> /old/home/bam/a (deleted)
lrwx------    1 bam      bam            64 Mar  4 09:22 11 -> /dev/pts/1
lrwx------    1 bam      bam            64 Mar  4 09:22 2 -> /dev/pts/1

(wow! it even gives the full pathname of the deleted file... Is it
possible to find other details, like the file size (not 64 bytes)?)
Brian May <bam@debian.org>

Reply to: