Hi Tony and Gordon, Thanks for your help. I have tried above your commands I couldn't see that size of the file. Usually the qmailbackup created like below format in backup location. 201604151929-backup.tar.gz 201604151929-qmailadminpasswd.tar.bz2 201604151929-qmailcontrolusers.tar.bz2 201604151929-spamassassin-files.tar.bz2 201604151929-squirrelmail-plugins.tar.bz2 201604151929-squirrelmail-prefs.tar.bz2 201604151929-vpopmail.sql.gz 201604151929-vpopmail.tar.bz2 Then i have tried to delete rm -f *.bz2 files or *.gz files. The above same steps followed on 01 April files. After that it doesn't show the 201604011929-backup.tar.gz file in backup location. but the extra 194 GB size occupied in my server which is above mentioned backup file size. I had checked mailbox folder size 386 GB and there is no other big size folder and files in my server. But i am wonder why it shows 580GB occupied in my hard disk. how to find out and solve this issue. I have run fail2ban and firewall also in my server. i have doubt anybody hacked or accessed my system from outside. Could anyone help me. On Fri, Apr 8, 2016 at 12:45 AM, Gordon Messmer <gordon.messmer at gmail.com> wrote: > On 04/06/2016 10:08 PM, Chandran Manikandan wrote: > >> qmailtoaster backup file which was around 184 GB in backup.gz type and i >> have removed .bz2 type file with the same backup/mailbkup directory. >> >> After removed .bz2 file it's gone backup.gz also which was 184 GB file. >> I have run this command locate .gz but couldn't find out it. >> >> how do i see the open files. >> > > You're most of the way there. You've probably identified the culprit. > The backup file consumed your space, and some process still has it open so > that it's not being freed on the filesystem. > > As root, look for deleted files: > > # ls -l /proc/*/fd/* | grep '(deleted)' > > For instance, among the output on my system, I see this: > > l-wx------. 1 gmessmer gmessmer 64 Apr 7 09:41 /proc/28087/fd/1 -> > /home/gmessmer/tmp.1 (deleted) > > The file /proc/28087/fd/1 appears as a symlink to a deleted file. In that > case, the process with PID 28087 has the file open. I can use "ps" to > determine what the process is, and terminate it appropriately. > > > _______________________________________________ > CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centos > -- *Thanks,* *Manikandan.C* *System Administrator*