My root partition is at 100%:
[root@mother /]# df Filesystem 1k-blocks Used Available Use% Mounted on /dev/hda9 497829 470571 1556 100% / But when I do [root@mother /]# du -x -s / 102374 . I come up way shy of the nearly half a gig that df reports has been used. When I specify all the dirs on the root partition, I get: 8934 bin 9440 boot 246 dev 4099 etc 18646 lib 12 lost+found 0 misc 1612 proc 3652 root 5969 sbin 869 tmp 59938 var Now my first panicky instinct is to think I've been hacked and I've got a root kit installed. Maybe. But we have been having trouble with our root partition filling up lately with out of control logging and other problems so I am trying to find an innocent explanation. Actually, I am surprised by the 100M number from du -x (seems to low) because just yesterday I was getting numbers closer to 350M.... In any case, chkrootkit didn't turn up any alarm bells, and neither did an rpm verify against fileutils-4.0.36-4.i386.rpm sysklogd-1.4-7.i386.rpm findutils-4.1.6-2.i386.rpm tcp_wrappers-7.6-18.i386.rpm net-tools-1.57-6.i386.rpm tripwire-2.3.0-58.i386.rpm passwd-0.64.1-4.i386.rpm xinetd-2.3.3-1.i386.rpm procps-2.0.7-8.i386.rpm Also, my du has the same timestamp and filesize as a friends machine with the same OS RHL7.1. So while none of this is conclusive, rootkit is not my first guess. I've thought about rebooting to see if the system has some space that it is not freeing up, but am loathe to kill one of my user's jobs that has been running in the background. There is also that mysterious /proc/kcore file whose size I've come to learn means nothing [root@mother /]# ls -l /proc/kcore -r-------- 1 root root 546328576 Mar 15 10:25 /proc/kcore because at 546M, it's bigger that the who root partition. Any thoughts? Thanks, John Hunter _______________________________________________ Bits mailing list [EMAIL PROTECTED] http://www.sugoi.org/mailman/listinfo/bits
