1748201 Members
2980 Online
108759 Solutions
New Discussion юеВ

Full root FS

 
Troyan Krastev
Regular Advisor

Full root FS

Hi,

I have a HP-UX 11.0 box with root file system 150MB.
Today I see it is 98% full and I can't find nothing wrong. All FS are mounted, no large files found using "du". I try lsof but I still
can not find the process that keep this large file open, I think.

Help!
17 REPLIES 17
A. Clay Stephenson
Acclaimed Contributor

Re: Full root FS

Hi Troyan,

Try this find command; you are less likely to miss a file than with du:

find / -xdev -size +2000

There should be very few files > 2000 blks in /

Clay
If it ain't broke, I can fix that.
Bill Hassell
Honored Contributor

Re: Full root FS

It's probably not a large file at all, but instead, a directory that doesn't belong in /. NOTHING goes in /except /etc /dev /sbin and perhaps /root for root's $HOME. Read the atttachment about root filesystem space.


Bill Hassell, sysadmin
James R. Ferguson
Acclaimed Contributor

Re: Full root FS

Hi:

Check for files that don't belong in /dev . If you have done something lika a 'tar' but mis-spelled "/dev/rmt/0m", for instance, then you didn't reference the device file but rather created a file and therefore added substantial disk space.

...JRF...
Patrick Wallek
Honored Contributor

Re: Full root FS

I agree with James. Look for something in /dev/rmt/ directory that is called om, omn, Om,Omn, lm,lmn, where the first character of the file is the letter O (NOT a zero [0]) or the letter L (not the number 1). This is probably the most common mistake when filling your / (root) file system.
Shannon Petry
Honored Contributor

Re: Full root FS

Some other goodies can also be found in the following locations,

/var/adm/crash
Look for everything
/var/adm
look for large acct files
/var/mail
look for big mail files...
/var/spool
look for dead print jobs that are huge!
check /var/dt for unused configurations, old error logs, etc...

check the dot files under /, especially if your running netscape! The cache directory defaults to 10MB. Also, check the /.dt directory. If there are problems, logs and junk will be there.

The best tool to use is "/usr/bin/du".
I.E.
> cd /
> du -sk *

This will show the use of all the directories!

Regards,
Shannon
Microsoft. When do you want a virus today?
A. Clay Stephenson
Acclaimed Contributor

Re: Full root FS

Hi:

I've thought of one other place your space may be hiding - beneath a mountpoint. You may need to unmount a filesystem (e.g. /home) and then do an ls /home to see if files and directories appear.

Just one more idea, Clay
If it ain't broke, I can fix that.
Troyan Krastev
Regular Advisor

Re: Full root FS

Hi A. Clay Stephenson,
silver:/ # find / -xdev -size +2000
/etc/rc.log.old
/etc/bgs/SD/bgssd
rc.log.old you already now what is, bgssd is a daemon for Best1 product.

Hi James and Patrick,
silver:/dev # du .
2 ./vg00
4 ./dsk
4 ./rdsk
0 ./diag/rmt
2 ./diag
2 ./rmt
0 ./rscsi
8 ./ptym
8 ./pty
8 ./pts
0 ./screen
0 ./telnet
0 ./krm
0 ./swap
2 ./symmvg01
2 ./symmvg02
2 ./symmvg03
2 ./symmvg04
4 ./symmvg05
0 ./symmvg06
58 .
Nothing wrong with /dev!?!

Hi Shannon,
You talk about /var, it si mount point:
lver:/ # ls -di *
677 bin 4 etc 3 lost+found
2 tmp 1303 cdrom 2 home 2 opt 2 usr 64 dev
502 lib 13 sbin 2 var
2 download 2 local 2 stand
/cdrom - empty
/bin - link to /usr/bin
/lib - link to /usr/lib
silver:/sbin # du .
3100 ./fs/hfs
3722 ./fs/vxfs
448 ./fs/cdfs
136 ./fs/nfs
72 ./fs/autofs
296 ./fs/lofs
8554 ./fs/vxfs3.3
16330 ./fs
12 ./lib/mfsconfig.d
60 ./lib/eisa
1028 ./lib
750 ./init.d
4 ./rc1.d
4 ./rc2.d
0 ./rc3.d
2 ./SnmpAgtStart.d
2 ./rc0.d
0 ./rc4.d
210 ./set_parms.d
47460 .

Hi again again A. Clay Stephenson,

Good idea, If the problem doesn't go away after reboot,
I have to check it!

Thanks all, but I still need help.
If you need some more information just let me know!!!

Vincenzo Restuccia
Honored Contributor

Re: Full root FS

You may have had a file opened by a process which has been removed while it was still open.
The normal way to cure this is find the process using something lik efuser, or reboot the system and see if that frees up the space.
If it does, monitor var closely and try to discover which process is writing to it.
Asad Malik
Frequent Advisor

Re: Full root FS

Hi
Check the /dev directory. Sometime a failed backup is dumped there. look for a non character file.
du -ka /dev |sort -rn|more will list the large file in ascending order.