1834351 Members
2088 Online
110066 Solutions
New Discussion

Re: / filesystem

 
Olebile Molefi
Occasional Contributor

/ filesystem

Guys please help me out here. I am administerin high availability systems. Somehow my / filesystem keeps filling up. I have a hard time tracing the problem. Where do u think i could look and possibly re-claim my space?
7 REPLIES 7
Praveen Bezawada
Respected Contributor

Re: / filesystem

Hi

1) Do not have too many directories on the / filesystem.
2) Check if any process is generating core dumps, these can fill up the space.
3) Check if any processes are opening files and writing into them on the root filesystem. You can use glance to monitor the open files.

Hope this helps.

...BPK...
Sridhar Bhaskarla
Honored Contributor

Re: / filesystem

I would suggest to run a cronjob every 5 mins to run du -x / . After sometime, compare the outputs and observe which directory is growing. Also, it would be better if you can bring down the server in singler user mode with only / and /stand mounted and check if any of the mounted directories are already having some data. If so, they will be hidden once the file systems are mounted during later run levels and be included in the used space.

Also search for core files

find / -xdev -name core -print

Find files of more than 5MB size

find / -xdev -size 10000 -print

-Sri

You may be disappointed if you fail, but you are doomed if you don't try
nancy rippey
Trusted Contributor

Re: / filesystem

One thing you may wish to do is to check for large files. The following command will accomplish this
find / -xdev -size +1000000c -exec ll {} \;

There could also be processes that are still writing to files even though space has been made free. To check:
Run lsof and redirect the output > /tmp/lsof.out
Look for entries that have /dev/dsk/vg## in the last column these are processes that can still be writing even though space has been cleared up. In my case it was a glance process. An example of the lsof is
emsagent 1502 root 0w VREG 64,0x2 47387 1884 / (/dev/vg00/l
vol3)
where=emsagent is the process name
1502= is the process number
/ = the filesystem that is being written to
/dev/vg00/lvol3=gives an inidication that the problem could be there.

By killing the process giving me problems I went from 97% full to 65%.

Hope this helps.
nancy
nrip
linuxfan
Honored Contributor

Re: / filesystem

Hi,

You could do
du -kx / |sort -n
(this would list the disk usage in KBytes )

Look for core files

Look in /dev/ and /etc/cmcluster directories.
The package log files in a cluster might get really huge.
du -ks /etc/cmcluster/* |sort -n

-HTH
Ramesh
They think they know but don't. At least I know I don't know - Socrates
Sachin Patel
Honored Contributor

Re: / filesystem

Hi Olebile,
You must having somewhere core file.
As other says run
du -sk /* > file1
then when you have system fill up run again
du -sk /* > file2 compare two file and find out why and where that directory is having large file.

Sachin
Is photography a hobby or another way to spend $
Joseph C. Denman
Honored Contributor

Re: / filesystem

A lot depends on what filesystems you have on the system. For example, if you did not create a /var filesystem, you could be filling up there. Of course I would do as above first and check for core file. Then I would do something like this:

cd /
touch /tmp/flist
cat /etc/fstab | cut -f2 -d" " | grep "/" > /tmp/flist
ls | while read line
do
if grep $line /tmp/flist > /dev/null 2> /dev/null
then
#do nothing
else
du -sk $line
fi
done

Hope this helps

...jcd...
If I had only read the instructions first??
A. Clay Stephenson
Acclaimed Contributor

Re: / filesystem

Hi,

You obviously have a problem; the / filesystem should not be growing at all! It's very common for someone to accidently recreate device files
like /dev/null or /dev/rmt/1m or to tar to /dev/rmt/Om (the letter) when they meant 0m (the number). That's the first thing to look for. You could be creating core files for processes running in the / filesystem. Use the find command to look for large files or files that have been modified in the last day. Only a few files in the / filesystem should actually be modified in a properly configured system.
If it ain't broke, I can fix that.