vg00 grew and I want to know if this is the culprit

[Cindy Wolford]

Hi Everyone,

OK, we had 2 disks go bad in our HP K420 server running Unix 10.20. They were replaced yesterday (May 17) but these 2 disks were not the root disks.

It's been a while so we decided to reboot the server as we replaced the hard drives....thinking it would be nice to refresh everything.

Everything went fine, system rebooted without issues, new hard drives were installed and everything was great.

Today, I noticed that vg00 is at 51% usage. This has always been at 26% so I knew something was up.

I found what may be the culprit, but I'm not 100% sure and was wondering if someone can help me.

I found a rather large file in my /dev. It is called /dev/hull (yes Hull) and it is almost 40MB in size. This is about how much vg00 has grown, and this file has a date of May 17 on it.

I did file hull and it says English text but when I want to view it (tail hull) I got gibberish.

Does anyone know what /dev/hull is? I've looked around and this is the only suspicious file to me plus the size is about right (since our vg00 is only 150Mb total). I was thinking of deleting this file but was afraid this may be a real file?

Any advice, tips?
Thanks in advance.
Cindy

[Mel Burslan]

looking at the placement of letter "h" and letter "n" looks like somebody fatfingered /dev/null for output on a rather heavy output generating command.

you can delete it without any worries I believe.

[Robert-Jan Goossens]

Hi Cindy,

What is the datestamp on the file ?

Search your crontabs for /dev/hull and the same for your /sbin/init.d.

I think someone made a typo, but better save then sorry :-)

Hope this helps,
Robert-Jan

[Sridhar Bhaskarla]

Hi Cindy,

I believe someone is trying to write to /dev/hull instead of /dev/null in their scripts.

I would check the scripts run by root priviliges as it's not possible to create a file under /dev directory unless the permissions on it allow others to write into it.

So, my suggestion would be to find out the culprit as the file may get created even after you removed it.

-Sri

[Sanjay_6]

Hi Cindy,

Looks like someone made a typo mistake. You can delete that file.

Hope this helps.

Regds

[Patrick Wallek · Accepted solution]

/dev/hull is NOT a real file. I am 99.99999% certain about that.

My guess is while testing a disk someone did something like:

# dd if=/dev/dsk/c?t?d? of=/dev/hull bs=??????

They type /dev/hull instead of /dev/null. I would get rid of the file. I seriously doubt that it is used for anything at all. Almost certainly it was a mistake. If you are really concerned mv it to /var/tmp temporarily and see what happens.

[John Poff]

Hi,

One other thing to check is:

fuser /dev/hull

to make sure that whatever created the file doesn't still have it open. Otherwise you might delete and still not get back your space.

JP

[Marvin Strong]

also do an ll on the file. what type of file is it? directory, character, block, link, normal?

that combined with the timestamp should give you some idea of when, and maybe where its coming from.

Looks to be an innocent typo.

[Cindy Wolford]

Hi everyone,

Thank you for the quick replies.

Since we just replaced 2 disks yesterday, it is very possible that my companion here typed /dev/hull when using the dd comand.

It makes sense now....thanks for pointing that out.

I went ahead, deleted this file and the vg00 is back to normal size. exact size as last weeks bdf output.

Thank you so much everyone!
Cindy

[Tim D Fulford]

Hull is a town in England on the East coat, so I guess whoever re-directed their output inteneded it to go there...

;-)

Tim