[CentOS] Re: HDD usage oddity

[Ugo Bellavance]

Stephen Harris wrote:
> On Wed, Nov 21, 2007 at 07:37:31PM -0500, Ugo Bellavance wrote:
>> 	2 of my Centos4 servers are showing weird behavior.
>>
>> [root at server1 ~]# du -sh /var/
>> 1.8G    /var/
>> [root at server1 ~]# df -h /var
>> Filesystem            Size  Used Avail Use% Mounted on
>> /dev/sda7             4.3G  3.9G  181M  96% /var
> 
> There are two things to consider.
> 
> ONE
> ===
> 
> If you have large block sizes and lots and lots of small files then
> "du" will report a number quite a lot smaller than "df".  "df" reports
> on actually amount free; "du" reports on apparent size of the files used.
> 
> TWO
> ===
> 
> If you delete a file that is still "open" (typically a log file, or
> a file being written to in /var/tmp) then Unix doesn't actually delete
> the file at that point; it removes the directory entry and marks the file
> to be deleted when no one is using it any more.
> 
> I've seen developers create debug logs in /tmp that grew to 2Gb then
> delete them to save space... while the program was still writing more
> debug messages, so they didn't save any space at all.
> 

That was it...  I deleted a log that was still opened by syslog, and 
other by snort.

After restarting snort and syslog, I got the right reading.

diskcheck will not stop bugging me :)

Thanks a lot!

Ugo