df - du discrepancy

2009-11-30 Thread Charlie Farinella 
I have an OpenBSD 4.4 machine running just a few things;
OSSEC, named and openvpn.

After it's been up for a few weeks I start seeing discrepancies between what df 
tells me is free space and how much space du reports as being used.  A few 
weeks ago I got 'disk full' errors and rebooted the thing which solved it for 
the moment, but not permanently.

Here is an example of what I'm seeing:

# df -h
Filesystem SizeUsed   Avail Capacity  Mounted on
/dev/sd0a  3.6G1.1G2.3G32%/

# du -sh *
2.0Kaltroot
4.5Mbin
44.0K   boot
6.6Mbsd
5.3Mbsd.rd
38.0K   dev
2.8Metc
94.0K   home
2.0Kipp.txt
6.0Klost+found
2.0Kmnt
2.0Kopenvpn-status.log
78.0K   root
10.7M   sbin
2.0Kstand
0B  sys
2.0Ktmp
505Musr
10.2M   var

This looks to me like there is a discrepancy of several hundred megabytes and 
each day I get an approximate 1% increase in the df used report.  How can I 
find out what's using this space and how can I prevent it?

thanks,

-- 
Charles Farinella
Appropriate Solutions, Inc.
603.924.6079

Re: df - du discrepancy

2009-11-30 Thread Theo de Raadt 
 After it's been up for a few weeks I start seeing discrepancies
 between what df tells me is free space and how much space du reports
 as being used.  A few weeks ago I got 'disk full' errors and rebooted
 the thing which solved it for the moment, but not permanently.

From the newfs manual page:

 -m free-space
 The percentage of space reserved from normal users; the mini-
 mum free space threshold.  The default value used is 5%.  See
 tunefs(8) for more details on how to set this option.

Re: df - du discrepancy

2009-11-30 Thread Otto Moerbeek 
On Mon, Nov 30, 2009 at 11:41:34AM -0700, Theo de Raadt wrote:

  After it's been up for a few weeks I start seeing discrepancies
  between what df tells me is free space and how much space du reports
  as being used.  A few weeks ago I got 'disk full' errors and rebooted
  the thing which solved it for the moment, but not permanently.
 
 From the newfs manual page:
 
  -m free-space
  The percentage of space reserved from normal users; the mini-
  mum free space threshold.  The default value used is 5%.  See
  tunefs(8) for more details on how to set this option.

That is one source of lost space that isn't really lost. Another one
is a file that is removed but still open by a program. Those bytes
will only be reclaimed once the program closes its file descriptor.
fstat(8) can be used to hunt the file and the offending program.

-Otto