LinuxQuestions.org
Support LQ: Use code LQCO20 and save 20% on CrossOver Office
Go Back   LinuxQuestions.org > Forums > Linux > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Tags used in this thread
Popular LQ Tags , ,

Reply
 
Thread Tools
Old 03-29-2008, 11:58 AM   #1
epoh
Member
 
Registered: Jan 2008
Posts: 43
Thanked: 0
Missing 200megs of space in /var - where is it??


[Log in to get rid of this advertisement]
Okay, I am loosing my mind.

This is the result of a df -k:


/var # df -k
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/cciss/c0d0p7 379303 336749 22971 94% /
/dev/cciss/c0d0p1 51358 7703 41003 16% /boot
/dev/cciss/c0d0p6 16610024 12481180 3285104 80% /home
none 1158676 0 1158676 0% /dev/shm
/dev/cciss/c0d0p2 33135496 29040252 2412040 93% /usr
/dev/cciss/c0d0p8 252863 234618 5190 98% /var



Then, if I cd to /var and do a du -sk:

/var # du -sk
41773 .


How is that possible? The system says I've got almost 250M allocated to /var, but if you actually check disk usage of var it says I've got 40megs. Where is the 200megs? What am I missing here? This server is gonna die in a fiery crash pretty soon if I can't figure this out. This is, obviously, an old system, with no other storage available to it. Even if there was, I cannot expand the filesystem while it's online, since it's running Redhat 7.2.

Any help would be greatly appreciated.
epoh is offline  
Tag This Post , ,
Reply With Quote
Old 03-29-2008, 12:22 PM   #2
colucix
Guru
 
Registered: Sep 2003
Location: Bologna, Italia
Distribution: OpenSUSE 11.1 CentOS 5.4 VectorLinux 6.0
Posts: 5,132
Thanked: 464
Maybe you have sparse files. A common one is /var/log/lastlog which can be very large sometimes: I have seen a lastlog of about 1 Gb in the past. Try
Code:
du -bs /var/log/lastlog
du -bs --apparent-size /var/log/lastlog
and see if the difference is your missing 200 Mb.
colucix is offline     Reply With Quote
Old 03-29-2008, 12:29 PM   #3
epoh
Member
 
Registered: Jan 2008
Posts: 43
Thanked: 0

Original Poster
Sadly that's not it. lastlog is only 32k. We cleaned that up yesterday.

Well, maybe I spoke too soon. ls -hal shows it's 18megs. That's not the 200 I'm looking for, but it's something, lol.

Last edited by epoh; 03-29-2008 at 12:32 PM..
epoh is offline     Reply With Quote
Old 03-29-2008, 12:40 PM   #4
epoh
Member
 
Registered: Jan 2008
Posts: 43
Thanked: 0

Original Poster
Quote:
Originally Posted by colucix View Post
Maybe you have sparse files. A common one is /var/log/lastlog which can be very large sometimes: I have seen a lastlog of about 1 Gb in the past. Try
Code:
du -bs /var/log/lastlog
du -bs --apparent-size /var/log/lastlog
and see if the difference is your missing 200 Mb.
Is there a way to search the filesystem for sparse files?
epoh is offline     Reply With Quote
Old 03-29-2008, 03:59 PM   #5
colucix
Guru
 
Registered: Sep 2003
Location: Bologna, Italia
Distribution: OpenSUSE 11.1 CentOS 5.4 VectorLinux 6.0
Posts: 5,132
Thanked: 464
Quote:
Originally Posted by epoh View Post
Is there a way to search the filesystem for sparse files?
You can do that by scripting. Using the stat command you can retrieve the total size of files in bytes and the actually allocated blocks. Comparing these two values (the latter multiplied by the block size) when the size of allocated blocks is smaller than the total size of the file, you can guess it is a sparse file. I've written a little script in bash to do this:
Code:
#!/bin/bash
gap=0
block_size=$(stat -c %B $0)
while read line
do
   size_in_bytes=$(echo $line | cut -f 1 -d \ )
   block_allocated=$(echo $line | cut -f 2 -d \ )
   file=$(echo $line | cut -f 3- -d \ )
   if [ $(expr $block_allocated \* $block_size) -lt $size_in_bytes ]
   then
      echo $file
      gap=$(( gap + ( $size_in_bytes - $block_allocated * $block_size ) / 1000 ))
   fi
done < <( find /var -type f -exec stat -c "%s %b %n" '{}' \; )
echo Rough estimate of total unallocated space in sparse files is: $gap k
It also gives you the total amount (in kbytes) of unallocated block in sparse files, that is a rough estimate of the gap between the output of df and du. This should bring to the missing 200 Mb. Maybe...
colucix is offline     Reply With Quote
Old 03-29-2008, 04:44 PM   #6
epoh
Member
 
Registered: Jan 2008
Posts: 43
Thanked: 0

Original Poster
Tried the script but i'm getting errors that -c isn't a valid flag. i'll have to look into it some more.

Quote:
Originally Posted by colucix View Post
You can do that by scripting. Using the stat command you can retrieve the total size of files in bytes and the actually allocated blocks. Comparing these two values (the latter multiplied by the block size) when the size of allocated blocks is smaller than the total size of the file, you can guess it is a sparse file. I've written a little script in bash to do this:
Code:
#!/bin/bash
gap=0
block_size=$(stat -c %B $0)
while read line
do
   size_in_bytes=$(echo $line | cut -f 1 -d \ )
   block_allocated=$(echo $line | cut -f 2 -d \ )
   file=$(echo $line | cut -f 3- -d \ )
   if [ $(expr $block_allocated \* $block_size) -lt $size_in_bytes ]
   then
      echo $file
      gap=$(( gap + ( $size_in_bytes - $block_allocated * $block_size ) / 1000 ))
   fi
done < <( find /var -type f -exec stat -c "%s %b %n" '{}' \; )
echo Rough estimate of total unallocated space in sparse files is: $gap k
It also gives you the total amount (in kbytes) of unallocated block in sparse files, that is a rough estimate of the gap between the output of df and du. This should bring to the missing 200 Mb. Maybe...
epoh is offline     Reply With Quote

Reply

Bookmarks


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
There is not enough space in folder var jorge_ivan Linux - General 3 07-21-2006 10:43 PM
Low disk space in /var wuqso Linux - General 2 05-22-2006 11:11 PM
no space left on /var BUT THERE IS!! branden_burger Linux - Software 5 05-31-2005 02:44 AM
Not enough space in /var/lib/mysql/ mtmacedo Linux - Software 1 10-22-2004 04:53 PM
Missing /var device sasklinuxuser Linux - General 2 05-14-2004 11:42 AM


All times are GMT -5. The time now is 10:05 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
RSS2  LQ Podcast
RSS2  LQ Radio
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: @linuxquestions
Open Source Consulting | Domain Registration