Recover / space

[Scott Frye_1]

We had a runaway log file fill up /. We moved the file out but / still shows 100%. How do I recover the disk space without rebooting?

Thanks

Scott

[Pete Randall]

Scott,

Unfortunately, until the process holding the log file open is closed, the space will not be released. Can you restart whatever service or application is using this log?


Pete

[Scott Frye_1]

Actually the log file was written to from an rc script at start up. The application vendor has a script that is waiting for a menu responce. The responce the are giving is "" which is invalid. So the log file was filled with '"" is an invalid responce'. The rc script is no longer running and the file stopped growing. We mv'd the file from /etc to /tmp but / never indicated the file was moved out.

[Sanjay_6]

Hi Scott,

Use lsof to identify the process that is probably holding the file open in the / filesystem even though the file was deleted.

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000072657091

The itrc doc id is KBRC00008039.

To download lsof if you don't have it already, try

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.73/

Hope this helps.

Regds

[Scot Bean]

Try deleting the file or moving it to /var/tmp/

On some machines, /tmp uses the same disk space as /

[Scott Frye_1]

Scot,

My uneducated assumption would be I would see / decrease and /tmp increase even if they were on the same disk. They are a part of the same vg.

[Fred Ruffet · Accepted solution]

As Pete says, even if you delete the file, until every process that opened the file die, space usage will remain.
Sanjay is right too on the method, but as you deleted the file, you may have a hard time telling lsof which file to look at. So can you post your rc script to see if any other process uses this file ?

Regards,

Fred

[Ermin Borovac]

To identify potential suspect processes that still might have unlinked files opened on the root filesystem, please run

# lsof +aL1 /

+L shows link count
+L shows only files having a link count less than
+L1 shows files with link count = 0 (< 1), i.e. unlinked files