On Tue, Feb 19, 2002 at 07:57:47AM +1100, Howard Lowndes wrote:
> When I do a df on my filesystem the /tmp partition shows:
>
> Filesystem 1k-blocks Used Available Use% Mounted on
> /dev/hda6 248895 177996 58049 76% /tmp
>
> but if I do:
> # for i in * ; do du -s $i ; done
> then I get:
>
[snip]
>
> No way does this add up to 177Mb, so where has it gone, or more
> importantly, how do I find out where it has gone?
`rm' doesn't delete the file immediately, it merely unlinks it. From the
unlink man page:
unlink deletes a name from the filesystem. If that name
was the last link to a file and no processes have the file
open the file is deleted and the space it was using is
made available for reuse.
If the name was the last link to a file but any processes
still have the file open the file will remain in existence
until the last file descriptor referring to it is closed.
It's common for apps to create temporary files then immediately unlink
them. The file doesn't appear in the directory, but it still uses
space on the device. Hence `df' shows space being used but `du' can't
tell you what's using it. `lsof +aL1 /tmp' should be able to show you
the file:
When +L is followed by a number, only files hav�
ing a link count less than that number will be
listed. (No number may follow -L.) A specifica�
tion of the form ``+L1'' will select open files
that have been unlinked. A specification of the
form ``+aL1 <file_system>'' will select unlinked
open files on the specified file system.
e.g.:
[root@dropbear ~]# lsof +aL1 /home
COMMAND PID USER FD TYPE DEVICE SIZE NLINK NODE NAME
mutt 15668 johnc 5r REG 3,69 1435 0 484808
/home/johnc/tmp/mutt-dropbear-15668-7 (deleted)
nedit 15683 johnc 5r REG 3,69 1435 0 484808
/home/johnc/tmp/mutt-dropbear-15668-7 (deleted)
Cheers,
John
--
whois [EMAIL PROTECTED]
GPG key id: 0xD59C360F
--
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug
