1

Possible Duplicate:
No free disk space

I have a linux server, which is reporting as having it's disk full, but as far as I can tell- the disk is not full, a df -h shows this:

/dev/mapper/VolGroup00-LogVol00<br>
                       19G   18G     0 100% /
/dev/xvda1             99M   27M   67M  29% /boot
tmpfs                 1.1G     0  1.1G   0% /dev/shm
/dev/mapper/VolGroup01-LogVol02  58G  7.5G   48G  14% /mnt/somewhere

This is a virtual server (using Xencenter), which has 2 drives, 20gb & 40gb mounted on it. If I look at the / I can only see approx 12gb in use, so where has the rest gone?

Community
  • 1
AliGibbs
  • 2,303
  • 20
  • 34

2 Answers2

6

Use lsof utils to find file that is delete but still open:

$ lsof +L1
ooshro
  • 10,874
  • 1
  • 31
  • 31
  • Ah hah- looks like its found 2 files (which look to be 7gb each in size), how would I delete these? In the normal manner? – AliGibbs Feb 18 '11 at 13:31
  • 2
    restart process, who open the files – ooshro Feb 18 '11 at 13:34
  • A more detailed explanation of why this happens can be found here: http://mradomski.wordpress.com/2007/01/08/finding-an-unlinked-open-file-and-other-lsof-uses/ – ThatGraemeGuy Feb 18 '11 at 14:46
0

My first question for questions like this is whether you checked using lsof to see if there are deleted files held open despite being marked "deleted." Second is usually to check for logfiles. Third is to check du for directory sizes to see if anything shows up or if running X use a graphical mapping utility to traverse directories.

Scarier thoughts move to what the server is used for...open to the Internet? Could someone have penetrated it and compromised it to store files? Rootkit check?

Bart Silverstrim
  • 31,092
  • 9
  • 65
  • 87
  • Cheers for the answer- ran a lsof +L1 as suggested by ooshro, and this has found 2 files. This server is not open to the internet. – AliGibbs Feb 18 '11 at 13:32