bdf and du report different disk usage for "/"

[newa]

Hi

On a rp3440/HP-UX11iV2 bdf reports "/" as 100% full with (1179552 kb used) but when I use du on all the subdirectories on that volume
du reports only (313264 kb used). I think one of the reason could be there are many bad sectors on this disk. What do you think? Any suggestions on further investigate this issue?

Becuse the OS sees / as 100% full I am afraid that this box will fail to reboot.

Thanks a lot in advance.

#####################
# bdf
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 1179648 1179552 96 100% /
/dev/vg00/lvol1 1776056 34112 1564336 2% /stand
/dev/vg00/lvol8 12156928 9528448 2626184 78% /var
/dev/vg00/lvol7 4194304 1794792 2380856 43% /usr
/dev/vg00/lvol6 2383872 19608 2345864 1% /tmp
/dev/vg00/lvol5 7446528 3749880 3688336 50% /opt
/dev/vg00/lvol4 2097152 855952 1231544 41% /home
/dev/vgsan/lvol1 2146959360 36144189 1978889279 2% /san01
#
#######################################
/ # ls
.secure dvdrom lost+found san01 tmp
.sw etc net san02 usr
bin home opt sbin var
dev lib roothome stand
/ #
# cd /
/ # ls
.secure dvdrom lost+found san01 tmp
.sw etc net san02 usr
bin home opt sbin var
dev lib roothome stand
/ #
#############################
/ # du -ks .secure .sw bin dev dvdrom etc lib lost+found net roothome sbin
0 .secure
80 .sw
0 bin
80 dev
0 dvdrom
201576 etc
0 lib
0 lost+found
0 net
520 roothome
111008 sbin
___________________________
313264 - is the totol

[James R. Ferguson]

Hi:

Large descrepencies between 'du' and 'bdf' are symptomatic of an inuse file having been removed.

Disk space is not returned to the system until the last process using a file is closed. A common and valuable technique is to open a file; immediately unlink() (remove) it; and continue to use it for the duration of the process. When the process terminates, without further adieu, the used disk blocks are returned to the available pool.

To find unlinked, open files that are consuming space, use 'lsof' from the HP-UX Porting Centre:

http://hpux.connect.org.uk/

To find open and unlinked files, use:

# lsof -a +L1 /dev/vg01/lv_out

(or)

# lsof +D /dev/vg01/lv_out +L1

Look for any files with an NLINK value of zero (0). These would be files with a zero link count that will vanish when the last process terminates. The SIZE/OFFSET column will offer the character size of the file in question.

Regards!

...JRF...

[singh sanjeev]

try to reduce the "/" utlization check for large file whihc can be moved,zipped or deleted.

primary concern may be reducing the utlization.

[Bill Hassell]

Don't worry at all about bad sectors. They will cause disk error messages in dmesg and also in syslog.log, but they will not be marked as used or removed by the filesystem.

As mentioned, there is likely an open file that has been marked for removal when the process terminates. However, you need to locate the big directories in / to make sure there are no junk directories and files in the / mountpoint. Use this command:

du -kx / | sort -rn |

The two largest directories must be /etc and /sbin. Anything else is incorrect and must be fixed (move the bad directory or remove it completely).

[James R. Ferguson]

Hi (again):

If the issue isn't an unlinked, open file or files) it's possible that you have a 'sparse' file in the root directory. In this case, 'bdf' will report a value that reflects what the "inflated" sparse file would be, whereas 'du' will report only the actual, allocated blocks. Copying a sparse file (with 'cp') will "un-sparse" a file. An 'ls' for a sparse file will show a the ultimate size too.

Regards!

...JRF...