On 04/07/2015 05:47 PM, Snow Leopard wrote: > Hello, > > what would be a best approach for the following situation: > > You have a web server and monitoring system reports that you short on > disk space. You login into web server computer and command 'df' indeed > shows that some partition is almost full. > > How would you resolve the issue if 'du' does not confirm that disk is full. > You 'du' all directories in the root of the partition but sum does not > adds up to match 'Use%' reported by 'df'. > > For such situation I would assume that some process holds huge open file > which was deleted (for example your web server was compromised). > > Question: how would you find the process which holds 'deleted' file? Greetings, I normally start looking for those deleted files by doing this: $ lsof | grep -i deleted Pass the partition into lsof to narrow the scope. Hope that helps! ~Stack~
Attachment:
signature.asc
Description: OpenPGP digital signature