CentOS 6.6 /var 100% but no big files

Question

I have a server that is showing /var as being 100% full, but running the following command 'du -ks * | sort -nr | more' does not show any large directories:

60824   lib
25084   log
3960    cache
180     run
144     named
120     spool
92      tmp
16      lock
8       empty
8       db
4       yp
4       vzquota
4       preserve
4       opt
4       nis
4       local
4       gdm
4       games
4       cvs
4       account
0       www
0       mail

lsof +L1 also doesn't look like it is any help:

NetworkMa   1299  root   15u   REG        9,2        0     0  785321  (deleted)/var/lib/NetworkManager/timestamps.XDFAVX
NetworkMa   1299  root   16u   REG        9,2        0     0  783383  (deleted)/var/lib/NetworkManager/timestamps.JIA1UX
NetworkMa   1299  root   17u   REG        9,2        0     0  785324  (deleted)/var/lib/NetworkManager/timestamps.RNA1UX
mysqld_sa  82900  root    0u   CHR      136,1      0t0     0       4  (deleted)/dev/pts/1
mysqld_sa  82900  root    1w   CHR      136,1      0t0     0       4  (deleted)/dev/pts/1
mysqld_sa  82900  root    2u   CHR      136,1      0t0     0       4  (deleted)/dev/pts/1
bash       97696  root    0u   CHR      136,0      0t0     0       3  (deleted)/dev/pts/0
bash       97696  root    1u   CHR      136,0      0t0     0       3  (deleted)/dev/pts/0
bash       97696  root    2u   CHR      136,0      0t0     0       3  (deleted)/dev/pts/0
bash       97696  root  255u   CHR      136,0      0t0     0       3  (deleted)/dev/pts/0
mysqld    392352 mysql    4u   REG        9,2        0     0  785317  (deleted)/tmp/ibytw90m
mysqld    392352 mysql    5u   REG        9,2        0     0  785319  (deleted)/tmp/ibYOXwrR
mysqld    392352 mysql    6u   REG        9,2        0     0  785320  (deleted)/tmp/ibSReURl
mysqld    392352 mysql    7u   REG        9,2        0     0  785322  (deleted)/tmp/ibYKluiQ
mysqld    392352 mysql   11u   REG        9,2        0     0  783396  (deleted)/tmp/ibgw0bSu
getty     407929  root  txt    REG 182,439793    32112     0  786460  (deleted)/vz/root/105/sbin/getty
getty     407931  root  txt    REG 182,439793    32112     0  786460  (deleted)/vz/root/105/sbin/getty
systemd-u 417840  root   10r   REG 182,439793  5661386     0 1179668  (deleted)/vz/root/105/lib/udev/hwdb.bin
cups-brow 855193  root    3r   REG 182,623649     1700     0 1574711  (deleted)/vz/root/104/etc/passwd

Anyone have any ideas on where to look next?

Thanks in advance

"du -sk * .[A-z]* | sort" gives:

du: mount point `named/chroot/var/named' already traversed
du: cannot access `.[A-z]*': No such file or directory
0       mail
0       www
120     spool
144     named
16      lock
180     run
25092   log
3960    cache
4       account
4       cvs
4       games
4       gdm
4       local
4       nis
4       opt
4       preserve
4       vzquota
4       yp
60824   lib
8       db
8       empty
92      tmp

"df -k /var" shows:

Filesystem     1K-blocks     Used Available Use% Mounted on
/dev/md2        20026172 19836516    189656 100% /

That df output indicates the root file system is full not just /var. — Brian, Mar 09 '15 at 12:21
Closing as a duplicate of this [search](http://serverfault.com/search?q=linux+disk+full) as there are lots of solutions to this problem here already. — user9517, Mar 09 '15 at 16:50

score 1 · Answer 1 · answered Mar 09 '15 at 12:23

1

I wonder why are you investigating high /var disk usage, but you don't have a separate /var partition, all of your disk space is /, and /var is only a directory inside it. Your approach is wrong from the start.

answered Mar 09 '15 at 12:23

drookie

8,051
1
17
27

Thanks for the comment. You know what, I am no longer sure why I have been fixated on /var - you are right, I should be looking at / as a whole... – Ian Mar 09 '15 at 12:32
I suggest using `du -h --max-depth=1 /` for a start. Narrow the search further. And yeah, lsof is good, especially for a situation "this just cannot be". – drookie Mar 09 '15 at 12:42

CentOS 6.6 /var 100% but no big files

1 Answers1