Hi,
2 of my Centos4 servers are showing weird behavior.
[root@server1 ~]# du -sh /var/ 1.8G /var/ [root@server1 ~]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 4.3G 3.9G 181M 96% /var
[root@server2 var]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 2.9G 2.7G 0 100% /var [root@server2 var]# du -sh /var/ 1.6G /var/
du seems to be reporting the right size
Anyone seeing this?
----- Original Message ----- From: "Ugo Bellavance" ugob@lubik.ca To: centos@centos.org Sent: Thursday, November 22, 2007 10:37:31 AM (GMT+1000) Australia/Brisbane Subject: [CentOS] HDD usage oddity
Hi,
2 of my Centos4 servers are showing weird behavior.
[root@server1 ~]# du -sh /var/ 1.8G /var/ [root@server1 ~]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 4.3G 3.9G 181M 96% /var
[root@server2 var]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 2.9G 2.7G 0 100% /var [root@server2 var]# du -sh /var/ 1.6G /var/
du seems to be reporting the right size
Anyone seeing this?
_______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
On Wed, Nov 21, 2007 at 07:37:31PM -0500, Ugo Bellavance alleged:
Hi,
2 of my Centos4 servers are showing weird behavior.
[root@server1 ~]# du -sh /var/ 1.8G /var/ [root@server1 ~]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 4.3G 3.9G 181M 96% /var
[root@server2 var]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 2.9G 2.7G 0 100% /var [root@server2 var]# du -sh /var/ 1.6G /var/
du seems to be reporting the right size
Neither is more "correct". They report different things. 'df' reports on the number of blocks in use by the filesystem. 'du' crawls the filesystem and reports the number of blocks used by files.
So what you have here is disk usage by stuff that isn't linked into the filesystem. This would mean deleted files that are still opened by processes.
Try 'lsof /var | grep deleted' to list deleted and open files.
On Wed, Nov 21, 2007 at 07:37:31PM -0500, Ugo Bellavance wrote:
2 of my Centos4 servers are showing weird behavior.
[root@server1 ~]# du -sh /var/ 1.8G /var/ [root@server1 ~]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 4.3G 3.9G 181M 96% /var
There are two things to consider.
ONE ===
If you have large block sizes and lots and lots of small files then "du" will report a number quite a lot smaller than "df". "df" reports on actually amount free; "du" reports on apparent size of the files used.
TWO ===
If you delete a file that is still "open" (typically a log file, or a file being written to in /var/tmp) then Unix doesn't actually delete the file at that point; it removes the directory entry and marks the file to be deleted when no one is using it any more.
I've seen developers create debug logs in /tmp that grew to 2Gb then delete them to save space... while the program was still writing more debug messages, so they didn't save any space at all.
Stephen Harris wrote:
On Wed, Nov 21, 2007 at 07:37:31PM -0500, Ugo Bellavance wrote:
2 of my Centos4 servers are showing weird behavior.
[root@server1 ~]# du -sh /var/ 1.8G /var/ [root@server1 ~]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 4.3G 3.9G 181M 96% /var
There are two things to consider.
ONE
If you have large block sizes and lots and lots of small files then "du" will report a number quite a lot smaller than "df". "df" reports on actually amount free; "du" reports on apparent size of the files used.
TWO
If you delete a file that is still "open" (typically a log file, or a file being written to in /var/tmp) then Unix doesn't actually delete the file at that point; it removes the directory entry and marks the file to be deleted when no one is using it any more.
I've seen developers create debug logs in /tmp that grew to 2Gb then delete them to save space... while the program was still writing more debug messages, so they didn't save any space at all.
That was it... I deleted a log that was still opened by syslog, and other by snort.
After restarting snort and syslog, I got the right reading.
diskcheck will not stop bugging me :)
Thanks a lot!
Ugo
-
Garrick Staples -
redhat＠mckerrs.net -
Stephen Harris -
Ugo Bellavance