> I understand that however, why does everyone, hp included state to look for large files within /home, /var, /tmp, /stand when they have / fill up? Mine is not at that level, however, I'm confused on the connection then.
Bill's rule #1 for full filesystems:
NEVER LOOK FOR BIG FILES.
(hopefully that got everyone's attention). First, a big file is *NOT* necessarily an extra file that should be removed. I personally took a call from an admin where his manager 'cleaned up' the large files and destroyed the system. The large files? vmunix and vmunix.prev
You manage disk space by percentage full and as a specific filesystem approaches 85-90%, you then look fof big DIRECTORIES, not big files. You do this by running the du command as in:
du -kx / | sort -rn | head -20
That shows you the largest directories in /. Do the same for /var and /tmp if they are getting full. Now that you've found large directories, look inside the directory. There may be 1000 files that are just 1 meg each...no large files but 1 Gb of space has been used, probably a big mistake. To sort the files within a directory by size, use:
ll | sort -rnk5 | head -20
Now as mentioned above, / is a separate filesystem. It is not affected by any other filesystem. In the / directory, you should see something like this:
75240 /
32728 /etc
32344 /sbin
14536 /etc/opt
13216 /etc/vx
As you can see, / is using 75 megs, but the two largest directories in / are /etc and /sbin, each using about 32 megs. This is normal, so if you see any other large directory in /, then there is a mistake. NOTE: always check / for files -- there should be none because all good sysadmins move root's HOME out of /. Check for a core file in / (also a sign of problem scripts or root's home is still in /)
Bill Hassell, sysadmin
