> -----Original Message----- > From: Scully, William P [mailto:[EMAIL PROTECTED] > Sent: Thursday, March 25, 2004 12:04 PM > To: [EMAIL PROTECTED] > Subject: File Space Utilization > > > On one of our servers we run the Ext3 file system and today a > DF command > showed the root filesystem was 96% full. I ran some FIND commands > looking for files updated today and "large". My goal was to find some > logs that I could maybe erase. What's interesting is that after a > graceful shutdown/reboot the same file space shows 72% full. (It's a > 3390-3, so this is a significant change in the amount of free blocks.) > What's more, another FIND command doesn't locate a newly-closed large > file which would explain such a big discrepancy. > > Any ideas on what's going on here? > > William P. Scully > Senior Systems Programmer > Computer Associates International, Inc >
One "weird" aspect of all UNIX filesystems (especially to us old-time IBM mainframers) is that you can have a "file" without a directory entry. That is, you can create a new file (inode) on a filesystem, and open it. While it is still open, you can unlink() the name which removes the name from the directory. However, because it is open, the space is not released. In fact, the application can continue to write to the unlink()'ed up open() file, thus using up more space. So find cannot find anything because there is not a directory entry. However, when you shut the application down (as you do when you reboot normally), the space for this "invisible" file is released. create and run the following script: #!/bin/sh exec >x.tmp rm x.tmp yes The first like creates a file "x.tmp" in the current subdirectory and causes STDOUT to point to it (i.e. it is "open"). The second line removes the "x.tmp" from the directory, but does NOT delete it because it is open to STDOUT from line 1. Line 3 will send a series of "y" outputs to STDOUT until (1) the filesystem fills up or (2) you do a control-c to stop it. If you have a second shell open, you can see the filesystem (via a df) becoming more used up. But you can never see what is doing it by any command that I can find. You will also see, vi df, that the space comes back when you finally stop the command. -- John McKown Senior Systems Programmer UICI Insurance Center Applications & Solutions Team This message (including any attachments) contains confidential information intended for a specific individual and purpose, and its' content is protected by law. If you are not the intended recipient, you should delete this message and are hereby notified that any disclosure, copying, or distribution of this transmission, or taking any action based on it, is strictly prohibited. ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
