/root file system 99%

[Suni Raj]

Hi,

My production server running HP-UX 11.11 has a /root file system size of 200 MB. It is now 99% and i can't see any files of large size to move out to free disk space.

Is there any way to find out what is filling it up and how can I free up the disk space without any ignite recovery.

Can anybody extend help to sort it out.

Regards
Raj

[Alzhy · Accepted solution]

find / -size +10000000c -xdev

should find files that are more than 10MB in your / partition.

[James R. Ferguson]

Hi Raj:

It is likely that you mis-typed the name of a backup device file and created a large file in '/dev/':

Look for a non-special file like '/dev/rmt/om' where the letter "o" was used instead of zero.

Regards!

...JRF...

[Kent Ostby]

Check first the /dev/ directory since there should be no large files there.

Also, check to make sure your filesystems are mounted (bdf).

If they aren't or if you know they weren't for some point in time, something could have gotten written to the mount point.

Please post output from the find listed by the top reply as well.. that could help.

Also, if you have something using up temporary space and filling up the system that way, you may be able to find it by doing:

ps -ef | cut -c48-80 | sort -nr | head

This will give you the top 10 processes by used CPU. If you see something there that shouldn't be running on the box, terminating it might fix your problem as well.

[Ken Grabowski]

The find command listed above will help you find the files. You may want to adjust the size down, you could have a lot of smaller files that are causing the problem.

A common cause of the root file system filling up is the root users home directory being on the / filesystem. If that is the case, create a /root (or location of your choice) file system for root. Move all of the root user files and dot files there. Don't forget to change root's home directory in /etc/password.

200MB for / should be plenty. The file system itself should not have any dynamic data being stored to it. You may want to run something like "find / -xdev -exec ls -ld {} \;" just to see if data is getting writen to this filesystem that shouldn't be.

[James George_1]

As mentioned earlier , could be possible that there is some files under the mountpoints.

And also, it is possible that some process is holding up the the space in the FS. So do # fsck on the file system and check for any process and see if u can kill that.
This should free up the space.

James

[Raj D.]

Hi Sunil ,

You can try finidng largest file in root filesystem. And then decide which is filling up the space.

# cd /
# find . -type f -xdev -exec ls -lR {} \; > out.txt

# cat out.txt | sort +4 -5nr > out1.txt
# head -n 20 out1.txt
[ Will list 20 largest files on root filesytem]

Hope this will help you,

Cheers,
Raj.

[HGN]

Hi

By this time you should have had the solution, you can always do a du -sk * from / and then put that output to a file,edit and file and remove the mount points and look for direcotires under root. There are chances some files are under /dev or /etc.

Rgds

HGN

[Bill Hassell]

The MOST important search is not for big files! You must first find the big directories. The reason is that there may be thousands of small files in some directory and they will never be be discovered with a search of large files. To get an quick listing of the buggest directories, do this:

du -kx | sort -rn | head

This will show the largest directories in Kb. /dev must never be more than 5-20 Kb in size yet if this is at the top of your list, someone logged in as root ran a backup command to a misspelled tape drive name (look in /dev/rmt for a very large file and remove it). /dev only has directories and device files which consume virtually no disk space. /sbin and /etc will be at the top of the list but anything else needs a closer look at the contents of the dire4ctory. To sort the files in a directory by size, use this:

ll /some_directory | sort -rnk5 | head

[SGUX]

make sure that all filesystems are mounted
When a filesystem which has mountpoint in "/" is not mounted it will fill "/" as well.
I've had a sqlnet.log filling up "/"

[Borislav Perkov]

Hi Suni,

You might have in /etc/lvmconfig directory *.old files from the volume group configuration files which can take lot of space.

Regards,
Borislav