Strange of filesystem size

[Hoang Chi Cong_1]

Hi all

I don't understand with this thing:
From bdf result, the filesystem show that nearly 6.6GB was used but when I check for the "du" command, it says only 2GB of data.

/dev/vg00/lvora 7340032 6893242 421219 94% /home/oracle

#du -sk /home/oracle
2185668 /home/oracle

Can anybody recommend a command to check realtime which file is writing on?
I need to check which file is writing on it.

Has any idea?

[Peter Godron]

Hi,
check with fuser -cu /home/oracle
which should give you the process ids/users using the disk.

With the process ids you should be able to establish which session is writing.

However, please note that filespace is only released after the process of deletion has completed, so bdf/du can show differences whilst deletion.

[Ivan Krastev]

The output rom bdf is different from du due to locked files/inodes from some applications. You can check what use/lock this files with fuser command.


cheers,
ivan

[Peter Godron]

Hi (again),
I completely forgot about lsof, which should be able to get you the filenames you need.

Binaries from:
http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.77/

With the manpage at:
http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.77/man.html

[Hoang Chi Cong_1]

Thanks all but I check with fuser command and I see a hundred of session...
How can I know which session?
The filesystem now almost full :(

[john korterman]

Hi,

you could try and search for big files, but the problem might be that someone has deleted a file which was in use when deleted: this behaviour is described in "man 2 unlink".

Check the relevant users' history files and cronjobs for suspicious file deletion, particularly logfiles.
Unfortunately, it will not help to recreate the file in question.

regards,
John K.