Re: / is suddenly 100% used
>>>>> "kmself" == kmself <kmself@ix.netcom.com> writes:
kmself> Not strictly. You can track things down through lsof or
kmself> the /proc filesystem, but it's hard to work out what files
kmself> are then accounting for large amounts of disk utilization.
kmself> In other words -- it's a hell of a lot easier to deal with
kmself> a file if you've got a file to deal with, rather than just
kmself> a filehandle (lsof).
In this case I would start of with "fuser -mv /partition", as I get
the general impression that no files on the partition should be in
use, as the it is "almost empty".
Once I found a suspicious process, I would do "ls -l /proc/$pid/fd"
replacing $pid with the process id to find the name of the file.
As an example with Linux 2.4.2:
[515] [snoopy:bam] ~ >fuser -mv /old/home/bam
USER PID ACCESS COMMAND
/old/home/bam bam 30621 f.... zsh
bam 30626 f.... sleep
[516] [snoopy:bam] ~ >ls -l /proc/30621/fd
total 0
lrwx------ 1 bam bam 64 Mar 4 09:22 0 -> /dev/pts/1
l-wx------ 1 bam bam 64 Mar 4 09:22 1 -> /old/home/bam/a (deleted)
lrwx------ 1 bam bam 64 Mar 4 09:22 11 -> /dev/pts/1
lrwx------ 1 bam bam 64 Mar 4 09:22 2 -> /dev/pts/1
(wow! it even gives the full pathname of the deleted file... Is it
possible to find other details, like the file size (not 64 bytes)?)
--
Brian May <bam@debian.org>
Reply to: