LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 07-01-2013, 04:15 AM   #1
captainentropy
Member
 
Registered: Mar 2010
Location: Berkeley
Distribution: Ubuntu, Mint, CentOS
Posts: 81

Rep: Reputation: 0
Mysteriously full disk


OK, I have a MAJOR problem. Every once in a while I completely run out of disk space, or so Ubuntu (11.04) tells me, when in reality there is no way that can be true. The error reads "The volume "Filesystem root" has only 6.4 MB disk space remaining" or some other absurdly low number. I have three drives mounted: sda is the home drive and is a 500GB drive; sdb is a 160GB drive that is being used to house my database for, and other files relevant to, Subsonic; sdc is a 3TB array (4 x 1TB drives in RAID5 attached to a 3ware 9650SE controller). I usually am alerted to this problem when I try to connect to my server via VNC, in that I can't connect. I can only see the desktop by using the monitor attached to the server (my TV, actually). I wish I could take a screenshot of the Disk Usage Analyzer but the OS says I don't even have disk space to store that.

sda has no more than maybe 80GB on it. It houses the OS and my programs. That's it. sdc is where I store everything and currently there is only 375GB used. So, WTF gives?

If I restart the machine the problem will sometimes resolve but I don't want to have to keep doing that. Could it be some rogue cache that I can't figure out?
 
Old 07-01-2013, 04:38 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
sounds like you're not appreciating that you have different filesystems here and as such only the one mentioned in the error message is relevant here. you said it was "Filesystem root", but that doesn't make sense, is it "/root" or maybe "/ (root)" ? Seems a little strange that you don't appear to have actually verified that there is that much disk space. a simple "df -h" would show you conclusively what the avaialbel space on each file system was.

to track down exactly where the space has gone, I usually recommend just running "du -xh --max-depth=1 /" and then for each total that looks excessive, change the directory path to that directory and run it again and you'll soon find where it's all gone.

Random reboots are clearly no way to fix anything.
 
1 members found this post helpful.
Old 07-01-2013, 06:22 AM   #3
fifnih
LQ Newbie
 
Registered: Apr 2012
Posts: 4

Rep: Reputation: Disabled
Did you look at the inodes available (df -i, then look at the IUse%)?
If IUse% is 99 or 100% you cannot create a new file on that filesystem.
 
Old 07-01-2013, 06:28 AM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
Quote:
Originally Posted by fifnih View Post
Did you look at the inodes available (df -i, then look at the IUse%)?
If IUse% is 99 or 100% you cannot create a new file on that filesystem.
Hmm, well the error IS that there's on 6.4mb free, doesn't look like an inode issue at all.
 
Old 07-01-2013, 06:37 AM   #5
fifnih
LQ Newbie
 
Registered: Apr 2012
Posts: 4

Rep: Reputation: Disabled
Yes, you are right.
One should think that the 'du -xh --max-depth=1 /' you suggested would show how captainentropy's disk is used.
 
Old 07-02-2013, 03:15 AM   #6
captainentropy
Member
 
Registered: Mar 2010
Location: Berkeley
Distribution: Ubuntu, Mint, CentOS
Posts: 81

Original Poster
Rep: Reputation: 0
OK, thanks acid_kewpie and fifnih. I have more than 6MB free this time, that example was just a recent one. It still says I have way more usage than I know I should, but I think I have found the culprits. But first, here's the results of df -i

Code:
Filesystem            Inodes   IUsed   IFree IUse% Mounted on
/dev/sda1            30269440  269352 30000088    1% /
none                 1019009     953 1018056    1% /dev
none                 1020976       5 1020971    1% /dev/shm
none                 1020976      70 1020906    1% /var/run
none                 1020976       2 1020974    1% /var/lock
/dev/sdc1            9773056     106 9772950    1% /media/db1
/dev/sdb1            183107584   23565 183084019    1% /media/data1
and du -xh --max-depth=1 /home/user (which is where your first command said the usage was).

Code:
4.0K	/home/taco/.gvfs
4.0K	/home/taco/.themes
121M	/home/taco/webdev
68K	/home/taco/.gkrellm2
2.6M	/home/taco/.local
664K	/home/taco/.macromedia
48K	/home/taco/tmp
164K	/home/taco/.pulse
20K	/home/taco/.gnupg
16K	/home/taco/.dbus
2.9M	/home/taco/.adobe
4.0K	/home/taco/Templates
92K	/home/taco/.gnome2
496K	/home/taco/.fontconfig
4.0K	/home/taco/Desktop
8.0K	/home/taco/.mplayer
4.0K	/home/taco/.nautilus
29M	/home/taco/x11vnc-0.9.12
852K	/home/taco/.gstreamer-0.10
25M	/home/taco/.cpan
4.0K	/home/taco/Pictures
5.5M	/home/taco/.config
12K	/home/taco/.mission-control
91M	/home/taco/Downloads
4.0K	/home/taco/Music
8.0K	/home/taco/bin
4.0K	/home/taco/.ssh
72K	/home/taco/.gconfd
8.0K	/home/taco/.tsclient
24K	/home/taco/.xine
4.0K	/home/taco/Documents
11M	/home/taco/3DM2_CLI-Linux_10.2.1_9.5.4
4.0K	/home/taco/.gnome2_private
86M	/home/taco/.mozilla
14M	/home/taco/libantlr3c-3.1.2
44K	/home/taco/.dvdcss
71M	/home/taco/.miro
4.0K	/home/taco/Public
8.0K	/home/taco/.fonts
1.8M	/home/taco/gwan_linux64-bit
37M	/home/taco/.VirtualBox
24K	/home/taco/.vnc
6.6M	/home/taco/.cache
8.0K	/home/taco/music
4.0K	/home/taco/Videos
4.0K	/home/taco/Ubuntu One
4.0K	/home/taco/.icons
2.4M	/home/taco/.gconf
580K	/home/taco/.thumbnails
12K	/home/taco/.cddb
35M	/home/taco/pms-linux-1.25.1
140K	/home/taco/.kde
428G	/home/taco/
 
Old 07-02-2013, 03:20 AM   #7
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
OK, so inodes are a non issue. 428G sounds like a decent sized amount of usage.

df -h will show you / us the actual usage of each partition. If you don't have the problem right now though, there's clearly no specific issue to explain.
 
Old 07-02-2013, 03:27 AM   #8
captainentropy
Member
 
Registered: Mar 2010
Location: Berkeley
Distribution: Ubuntu, Mint, CentOS
Posts: 81

Original Poster
Rep: Reputation: 0
now, I said I think I found the culprits. Here's what I'm pretty confident it is. I couldn't find folder hogging up space other than my home directory, so I figured it mush be a hidden file of some kind. I used du -ah | sort -n > file to redirect all the data to a file I could sort through. Looking for the largest files I found two,

Code:
208G	./.xsession-errors
220G	./.xsession-errors.old
428GB. That about makes up the missing space.

Now, this is where I'm concerned. I looked at the massive logs and there are thousands and thousands of entries like this:
Code:
** (vino-server:1642): WARNING **: VNC authentication failure from 'host189-2-static.198-31-b.business.telecomitalia.it'

25/05/2013 04:02:53 PM rfbAuthPasswordChecked: password check failed
25/05/2013 04:03:09 PM [IPv4] Got connection from client zulu845.server4you.de
25/05/2013 04:03:09 PM   other clients:
25/05/2013 04:03:09 PM      host189-2-static.198-31-b.business.telecomitalia.it
25/05/2013 04:03:09 PM      host189-2-static.198-31-b.business.telecomitalia.it
25/05/2013 04:03:09 PM      zulu845.server4you.de
25/05/2013 04:03:09 PM      host189-2-static.198-31-b.business.telecomitalia.it
25/05/2013 04:03:09 PM      zulu845.server4you.de
25/05/2013 04:03:09 PM      host189-2-static.198-31-b.business.telecomitalia.it
25/05/2013 04:03:09 PM      zulu845.server4you.de
25/05/2013 04:03:09 PM      host189-2-static.198-31-b.business.telecomitalia.it
25/05/2013 04:03:09 PM      zulu845.server4you.de
25/05/2013 04:03:09 PM      host189-2-static.198-31-b.business.telecomitalia.it
25/05/2013 04:03:09 PM      host189-2-static.198-31-b.business.telecomitalia.it
25/05/2013 04:03:09 PM      zulu845.server4you.de
25/05/2013 04:03:09 PM      host189-2-static.198-31-b.business.telecomitalia.it
25/05/2013 04:03:10 PM Client Protocol Version 3.3

** (vino-server:1642): WARNING **: Deferring authentication of 'zulu845.server4you.de' for 5 seconds


** (vino-server:1642): WARNING **: VNC authentication failure from 'zulu845.server4you.de'

Some are from Italy, others from Switzerland, and Germany. It looks like someone/group is trying to gain access to my server, and the logs are filling up with their (failed??) attempts.

So, 1) what should I do about this?, and 2) is there a way to keep the log files from growing so huge? Some config file to edit?

Thanks!
 
Old 07-02-2013, 03:39 AM   #9
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
OK, so that looks fun! If it really is FULL of those connection logs, then you should stop that being possible in the first instamce. There's no need to make the messages not get logged if you don't have the errors in the first place. I think VNC is AWFUL. I would NEVER advocate it's use. Especially not on the internet directly like you appear to have. I would suggest you stop this being possible, and only expose secure services like SSH to the internet. You can reasonably safely tunnel VNC over SSH, and that would mean that no one could even attempt to conenct to VNC without first logging in over SSH.

As for the file itself, there are plenty of people asking about that, e.g. http://ubuntuforums.org/showthread.php?t=1517991&page=2 but I would *REALLY* suggest you don't. This log file has served a great purpose here, even if you found the contents in a roundabout way. Don't ditch it, as poorly as it is managed by the X server.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Disk Full OtagoHarbour Linux - General 5 02-03-2013 10:20 AM
Disk full KennyV SUSE / openSUSE 4 07-12-2011 08:15 AM
Disk full - what do I do now? rwhitworth SUSE / openSUSE 8 10-21-2007 02:19 AM
Disk full... cactusface Linux - Newbie 5 08-02-2007 04:48 PM
disk stats not updating after deletion of file.. disk full joecool118 Linux - General 2 04-10-2006 01:23 PM


All times are GMT -5. The time now is 11:03 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration