can't find what fills up my file system

[Dragos Preutu]

I have used find -type f -xdev -size +50000c
and du -sk * and cannot find the large file

Is there any way the large file would be hidden?

[Hein van den Heuvel]

One very effective way to hide a file is to create it in a directory which is later used as a mountpoint.

Something like

#mkdir /tmp
#dd if=/dev/zero count=200000 of=/tmp/x
#mount /tmp

This will 'nicely' hide 100M worth of space where it hurts most (/)

Hein.

[Rick Garland]

You can put it in order as well, may make the reading a bit easier.

in the filesystem of question

# cd /home using as example
# du -x -ka . | sort -nr | more
This du command is saying to list the files by size in ascending order and to not cross mount points, so this will stay in the /home filesystem.

If you suspect hidden files, this won't do it. But it will make it easier to read the output.

[James R. Ferguson · Accepted solution]

Hi:

To add, it is possible that the file consuming your space has long vanished.

A common technique with temporary files is to create them and immediately 'unlink()' (remove) them. This is a convenient coding choice.

Until then last process using the file terminates, the disk blocks allocated to the file remain.

You can use 'lsof' to look for files with link counts of zero. These would be ones still in use by a process.

Regards!

...JRF...

[Dragos Preutu]

I have looked at every file in ll -a and they are all really small files in a 4 GB fs.
This file system is used a temp space for processes, still I would expect to see the file that is writing to.
If there a hidden folder, is there any way I can discover it?

[Dragos Preutu]

I have stop and start part of the processes using the temp file system and that cleard about half of the space

[Dragos Preutu]

see above