On Wednesday 21 July 2010 05:03, van Sleeuwen, Berry wrote:
>On a SLES8 guest we have found that file /var/log/lastlog is reported to
>be 26G. Also the /var/log/faillog is reported to be 2G. But, the /var is
>located on a 3390 model 3. So that disk, that also contains other
>directories, is only 2.3 G. Command df shows that the / is 83% in use.
>
>How can it be that files can grow larger than the disk they reside on?
>And why would df report on 83% instead of 100% usage?
Because they are sparse files. Linux only allocates blocks for a file that
have actually been written, so if a process creates a file and seeks a couple
of gigabytes into it before the first write, the file size is reported as
over 2GB, but it really only uses the blocks actually written after that
point. Use du(1) to report the actual space used by those files.
IIRC, sparse files are used for these logs because they are in a kind of
record-oriented format, where the position in the file is the record key.
That's why you need to use last(1) and faillog(8) to look at those files:
they are not plain text files the way /var/log/messages is.
- MacK.
-----
Edmund R. MacKenty
Software Architect
Rocket Software
275 Grove Street · Newton, MA 02466-2272 · USA
Tel: +1.617.614.4321
Email: m...@rs.com
Web: www.rocketsoftware.com
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For more information on Linux on System z, visit
http://wiki.linuxvm.org/
