LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices



Reply
 
Search this Thread
Old 03-29-2008, 11:58 AM   #1
epoh
Member
 
Registered: Jan 2008
Posts: 73

Rep: Reputation: 15
Missing 200megs of space in /var - where is it??


Okay, I am loosing my mind.

This is the result of a df -k:


/var # df -k
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/cciss/c0d0p7 379303 336749 22971 94% /
/dev/cciss/c0d0p1 51358 7703 41003 16% /boot
/dev/cciss/c0d0p6 16610024 12481180 3285104 80% /home
none 1158676 0 1158676 0% /dev/shm
/dev/cciss/c0d0p2 33135496 29040252 2412040 93% /usr
/dev/cciss/c0d0p8 252863 234618 5190 98% /var



Then, if I cd to /var and do a du -sk:

/var # du -sk
41773 .


How is that possible? The system says I've got almost 250M allocated to /var, but if you actually check disk usage of var it says I've got 40megs. Where is the 200megs? What am I missing here? This server is gonna die in a fiery crash pretty soon if I can't figure this out. This is, obviously, an old system, with no other storage available to it. Even if there was, I cannot expand the filesystem while it's online, since it's running Redhat 7.2.

Any help would be greatly appreciated.
 
Old 03-29-2008, 12:22 PM   #2
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,509

Rep: Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957
Maybe you have sparse files. A common one is /var/log/lastlog which can be very large sometimes: I have seen a lastlog of about 1 Gb in the past. Try
Code:
du -bs /var/log/lastlog
du -bs --apparent-size /var/log/lastlog
and see if the difference is your missing 200 Mb.
 
Old 03-29-2008, 12:29 PM   #3
epoh
Member
 
Registered: Jan 2008
Posts: 73

Original Poster
Rep: Reputation: 15
Sadly that's not it. lastlog is only 32k. We cleaned that up yesterday.

Well, maybe I spoke too soon. ls -hal shows it's 18megs. That's not the 200 I'm looking for, but it's something, lol.

Last edited by epoh; 03-29-2008 at 12:32 PM.
 
Old 03-29-2008, 12:40 PM   #4
epoh
Member
 
Registered: Jan 2008
Posts: 73

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by colucix View Post
Maybe you have sparse files. A common one is /var/log/lastlog which can be very large sometimes: I have seen a lastlog of about 1 Gb in the past. Try
Code:
du -bs /var/log/lastlog
du -bs --apparent-size /var/log/lastlog
and see if the difference is your missing 200 Mb.
Is there a way to search the filesystem for sparse files?
 
Old 03-29-2008, 03:59 PM   #5
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,509

Rep: Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957
Quote:
Originally Posted by epoh View Post
Is there a way to search the filesystem for sparse files?
You can do that by scripting. Using the stat command you can retrieve the total size of files in bytes and the actually allocated blocks. Comparing these two values (the latter multiplied by the block size) when the size of allocated blocks is smaller than the total size of the file, you can guess it is a sparse file. I've written a little script in bash to do this:
Code:
#!/bin/bash
gap=0
block_size=$(stat -c %B $0)
while read line
do
   size_in_bytes=$(echo $line | cut -f 1 -d \ )
   block_allocated=$(echo $line | cut -f 2 -d \ )
   file=$(echo $line | cut -f 3- -d \ )
   if [ $(expr $block_allocated \* $block_size) -lt $size_in_bytes ]
   then
      echo $file
      gap=$(( gap + ( $size_in_bytes - $block_allocated * $block_size ) / 1000 ))
   fi
done < <( find /var -type f -exec stat -c "%s %b %n" '{}' \; )
echo Rough estimate of total unallocated space in sparse files is: $gap k
It also gives you the total amount (in kbytes) of unallocated block in sparse files, that is a rough estimate of the gap between the output of df and du. This should bring to the missing 200 Mb. Maybe...
 
Old 03-29-2008, 04:44 PM   #6
epoh
Member
 
Registered: Jan 2008
Posts: 73

Original Poster
Rep: Reputation: 15
Tried the script but i'm getting errors that -c isn't a valid flag. i'll have to look into it some more.

Quote:
Originally Posted by colucix View Post
You can do that by scripting. Using the stat command you can retrieve the total size of files in bytes and the actually allocated blocks. Comparing these two values (the latter multiplied by the block size) when the size of allocated blocks is smaller than the total size of the file, you can guess it is a sparse file. I've written a little script in bash to do this:
Code:
#!/bin/bash
gap=0
block_size=$(stat -c %B $0)
while read line
do
   size_in_bytes=$(echo $line | cut -f 1 -d \ )
   block_allocated=$(echo $line | cut -f 2 -d \ )
   file=$(echo $line | cut -f 3- -d \ )
   if [ $(expr $block_allocated \* $block_size) -lt $size_in_bytes ]
   then
      echo $file
      gap=$(( gap + ( $size_in_bytes - $block_allocated * $block_size ) / 1000 ))
   fi
done < <( find /var -type f -exec stat -c "%s %b %n" '{}' \; )
echo Rough estimate of total unallocated space in sparse files is: $gap k
It also gives you the total amount (in kbytes) of unallocated block in sparse files, that is a rough estimate of the gap between the output of df and du. This should bring to the missing 200 Mb. Maybe...
 
  


Reply

Tags
redhat, storage, var


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
There is not enough space in folder var jorge_ivan Linux - General 3 07-21-2006 10:43 PM
Low disk space in /var wuqso Linux - General 2 05-22-2006 11:11 PM
no space left on /var BUT THERE IS!! branden_burger Linux - Software 5 05-31-2005 02:44 AM
Not enough space in /var/lib/mysql/ mtmacedo Linux - Software 1 10-22-2004 04:53 PM
Missing /var device sasklinuxuser Linux - General 2 05-14-2004 11:42 AM


All times are GMT -5. The time now is 05:18 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration