Dear Gurus,
My questions were: Why does my root file system fills up to 97%? How can
I find the culprit?
Finally, I did find the culprit using "du" (see below). The culprit was...
... NETSCAPE !! Some time ago, I had to run Netscape as root. And Netscape
stored its "cache" files in /.netscape-cache/ and those files summed up to
nearly 10 Mb.... I also found with du other files which should have been
in another location (my fault).
Thanks a lot for your numerous answers (see below). Here is the summary:
1) the tmp directory can be momentarily quite large.
"If your /tmp directory is part of the root (/) file system, then
you will often get file system full messages because many temporary
files are created in /tmp during normal system operations such
as editing, reading mail, compiling, etc. These files come
and go, so the file system may be full for some minutes and then
have room again". (farrell_at_pangea.stanford.edu)
(olle_at_cb.uu.se)
"The root is a relatively small file system (64 - 128 MB)
"and it is easy to fill up. In the case of files in /tmp,
"many applications will open the file, remove the name
"and then use it. As long as they keep it open, it uses
"space. This makes it difficult to see. (alan_at_nabeth.cxo.dec.com)
Moreover:
"If someone's process creates a large file in / (i.e. /tmp). and it
"is removed, the system will not truly release it until the process
"exits." (<grant_at_psc.edu>)
"When the file is closed or the process exits, the space is
"returned" (alan)
It is therefore a good idea to move the tmp directory to another file
system (not /) but it is a bad idea to simply make a link:
"You should really find another disk partition to mount on /tmp.
"I think it should be at least 20 Mb in size for a workstation
"and up to 50 Mb for a system with a lot of users" (Phil Farrell)
"Is /tmp part of "/" ?
"Is /var part of "/" ?
"If yes, then repartition your disk and put these two directories
"in their own partition... Remember, the smallest "/" you have the
"less problem you'll encounter" (ollivier.robert_at_eurocontrol.fr)
"If you have a free partition, I would recomend having /tmp on a
"seperate filesystem. There was a good discussion of this a while
"ago, it is attached" (<ckrieger_at_latrade.com>)
2) Have a look in /dev
Sometimes one can make a typo and type /dev/rmtoh (letter o) instead
of /dev/rmt0h (zero) -for example- and this will put the tar file rmtoh
in /dev (<jgmicon_at_sandia.gov>)
(<Anil.Khullar_at_mailhub.gc.cuny.edu>)
(<grant_at_psc.edu>)
3) look for "core" files (<apaige_at_idulab.gov>)
4) try "lsof" which shows which processes have files open
"I found "lsof" to be very useful for tracking
"this problem. It will show you what processes have what files open
"and also displays the size of the files (as well as many other
"things). (<t.hespe_at_unsw.edu.au>)
5) use "find"
"See "man find", where you can list all files in the root F.S
"( ignoring mounted F.Ss )" (nvbr_at_iitk.ernet.in)
6) Check /var:
"For us /var is part of /. So, some possible areas are /dev/* (look
"for a large file), /var/adm/syslog.dated/* (compress old log files),
" /var/adm/wtmp (may need to be saved and truncated), /var/spool/lpd
"(check for many or large spooled print jobs), /var/spool/mqueue
"(check for a large queue or large dead.letter file), /var/spool/mail
"(is someone using this area to store files?).
(<rjackson_at_portal.gmu.edu>)
7) Finally, use "du", particularly "du -x" and "du -s"
(marco_at_gore.afep.cornell.edu)
(IY_at_vilspa.esa.es)
(<grant_at_psc.edu>)
(Chander Ganesan <C_at_Asu.Edu>)
(munhoven_at_olive.msm.ulg.ac.be)
("Tim Hespe" <t.hespe_at_unsw.edu.au>)
Thanks again to all of you,
Jean-Loup
--
---------------------------------------------------------------------
| Jean-Loup Risler | |
| Universite de Versailles | Tel: (33-1) 39 25 45 54 |
| Lab. Genome et Informatique | Fax: (33-1) 39 25 45 69 |
| Batiment Buffon | |
| 45 Avenue des Etats-Unis | email: risler_at_genetique.uvsq.fr |
| 78035 Versailles Cedex France | |
---------------------------------------------------------------------
Received on Sat Sep 21 1996 - 17:09:26 NZST