l i n u x - u s e r s - g r o u p - o f - d a v i s
L U G O D
 
Next Meeting:
October 20: Web Application Hacking: How to Make and Break Security on the Web
Next Installfest:
TBD
Latest News:
Oct. 10: LUGOD Installfests coming again soon
Page last updated:
2001 Dec 30 17:09

The following is an archive of a post made to our 'vox-tech mailing list' by one of its subscribers.

Report this post as spam:

(Enter your email address)
Re: [vox-tech] Disk Space Command
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [vox-tech] Disk Space Command



On Sat, Aug 04, 2001 at 12:52:28AM -0700, Gabriel Rosa wrote:
> I like to use:
> 
> du -S | sort -n | more

To find attached files normally I do:
  du -k / 2> /dev/null | sort -nr | less

  Which will show largest directories first... and throw away error
messages and looks like:
# 5321924 /
# 3112728 /usr
# 1878844 /usr/home
# 1843476 /usr/home/msimons
# 471340  /usr/src
# 439644  /usr/home/msimons/test6
# 394144  /usr/home/msimons/images
# 394052  /usr/home/msimons/images/test8


  If you have any sort of network file sharing going you will want
to add '-x' to the df, and list all the local mount points you want check
like (df -kx / /var /home ...).  -x will keep du from taking years to
stat every single file across the network.


  The trick is that on a unix platform the disk space associated with a
file is not actually freed up until the last reference to the file is
removed.  Processes hold a reference to a file when they have it 
open... so you can delete huge files and find no disk space shows up
in df as freed.  The lame method of "fixing" this is to reboot... but
there are other ways.

  Then to find files that have been unlinked by are in use by a 
process I run:

  find /proc/[0-9]*/fd -type l -ls 2>/dev/null | grep deleted | less

which looks kinda like this:
# 1175617540    1 l-wx------   1 root     root           64 Aug  4 00:54 
#   /proc/17938/fd/4 -> /var/lib/dpkg/updates/0020\ (deleted)
# 1337360388    1 lr-x------   1 root     root           64 Aug  4 00:54 
#   /proc/20406/fd/4 -> /var/log/distributed-net.log.new\ (deleted)
# 1513062418    1 l-wx------   1 root     root           64 Aug  4 00:54 
#   /proc/23087/fd/18 -> /var/run/apache.lock.331\ (deleted)

  The trick is to get an accurate report you must be root a user
can only look into their own fd directories.  Also if you notice
this report doesn't actually show the file size... now since the files 
above are deleted you can't do an ls -l to figure out which are the 
big files... but as root you can do:

# root@mirage:~> 
  find /proc/[0-9]*/fd -type l -ls 2> /dev/null | 
    perl -ane 'm/(deleted)/ or next; $, = " "; 
               print -s $F[10], splice(@F, 10, -1), "\n";' | sort -nr | less

Which looks kinda like:
# 736256 /proc/24075/fd/28 -> 
#    /usr/home/msimons/.mozilla/default/NewCache/_CACHE_001_\ 
# 378685 /proc/20406/fd/4 -> 
#    /var/log/distributed-net.log.new\ 
# 135168 /proc/24075/fd/27 -> 
#    /usr/home/msimons/.mozilla/default/NewCache/_CACHE_MAP_\ 
# 4096 /proc/24075/fd/30 -> 
#    /usr/home/msimons/.mozilla/default/NewCache/_CACHE_003_\ 
# 4096 /proc/24075/fd/29 -> 
#    /usr/home/msimons/.mozilla/default/NewCache/_CACHE_002_\ 

  Basically this prints out the list of large to small deleted files
which are still in use by a running process.  If you find something 
big sitting around, figure out what the process ID belongs to... 
(ps auxww | grep PROCESS_ID)... then end, restart, or kill the
one using the file.
  If you find a system daemon still attached to a deleted log file
you need to look into your log rotation scripts because they are
broken... the scripts that rotate and compress logs need to 
alert the daemons to reattach to the new log file and I've seen
a few systems recently which aren't doing this correctly (Mandrake
something or other and some Debian boxes that people install their
own daemons from source instead of packaged ones).

   TTFN,
     Mike


LinkedIn
LUGOD Group on LinkedIn
Sign up for LUGOD event announcements
Your email address:
facebook
LUGOD Group on Facebook
'Like' LUGOD on Facebook:

Hosting provided by:
Sunset Systems
Sunset Systems offers preconfigured Linux systems, remote system administration and custom software development.

LUGOD: Linux Users' Group of Davis
PO Box 2082, Davis, CA 95617
Contact Us

LUGOD is a 501(c)7 non-profit organization
based in Davis, California
and serving the Sacramento area.
"Linux" is a trademark of Linus Torvalds.

Sponsored in part by:
O'Reilly and Associates
For numerous book donations.