Re: [tlug] Something is eating my disk space

[bruno raoult <bruno@example.com>]

Stephen J. Turnbull wrote:
> "find" is the wrong tool for the job, anyway.  The problem is disk
> usage, so you want "du", as Josh suggested.  Once you've isolated the
> subtree that's filling up, a direct "ls -la" will show any problem
> files.  (You want the -a mostly in case you've been hacked.  Sane
> programs don't write megabytes to dot-files.  Did I say "sane"?  Oops,
> OK, if you've got spamassassin, Mozilla, or any GNOME program
> installed, you might as well be hacked from this point of view....)
> 
> du doesn't count inodes, which can be a problem, as somebody
> mentioned, but that will generate a different message (yes, I have the
> Serder Argic T-shirt).  IIRC on most Unix filesystems inodes do not
> come out of "user space", anyway; they're accounted for by the
> (usually) huge overestimate of space reserved for root.

Sometimes these tools (find, du, etc...) are not enough, if someone was
silly enough to clean a file with "rm" without wondering if the file was
opened or not by an application.
If already opened, the "rm" will have no effect on the remaining disk
space until the using process is killed.
I saw this so many times from some "admins" that it is worth noticing it
I guess...

The plan to clean these files without killing the writing apps is often
a "cat /dev/null > the-big-file" (good for logfiles as they are opened
in append mode). You will immediately see your file being as big as
before, but your disk got fresh air (as the new writings will still be
done at the current end of the opened file -which gives the size as
given by ls- without allocating the previous blocks -which accounts for
your disk space-).

br.

PS. To play with this feature you can try this small program.
#include <fcntl.h>
#include <unistd.h>
main(ac, av)
        char **av;
{
        int f;

        if ((f=open(*(av+1), O_RDWR|O_CREAT))>=0) {
                lseek(f, 1000000L, SEEK_SET);
                write(f,"1",1);
                close(f);
        } else {
                perror("cannot open file");
        }
}
If you run it, ls will show you a big file, du will show you a 1 block
file (and available disk space will have seen a 1 block decrease too in
the process).

-- 
GPG Key: 653514E5 (http://www.raoult.com/gpg)
--
Real Men do not use signatures.

Attachment: signature.asc
Description: OpenPGP digital signature