I have 2 identical machines (same motherboards, HD's etc) both running debian testing

on machine 1 i run df -h and get the following

/dev/hdb1 6.5G 382M 5.8G 7% /
tmpfs 443M 0 443M 0% /dev/shm
/dev/hdb9 22G 1.3G 19G 7% /data
/dev/hdb8 37G 1.3G 34G 4% /home
/dev/hdb7 24G 459M 22G 3% /usr
/dev/hdb6 23G 22G 102M 100% /var

indicating that /var is full

if i go into var and do du -a it reports there is only 179 meg used. If i use a tool called dirsum it reports the same amount of usage. I have looked in every directoy but cant fine any large files. Befor e i deleted some logfiles i was getting disk full errors so there really does seem to be soemting there.

My immediate thought was maybe the disk is failing, but on the other machine, it also reports that there is 17gig used in var, but du and dirsum both report that there is only a small amount of usage.

I'm unsure where to look next

Any help appreciates as this is a production machins and I'm nervous about it failing.

tia tony

If you delete a (log)file, while some application (syslog, apache, whatever) still has open, then the file will not be actually deleted until the application closes it.

So, you now have two options:
1. reboot. All programs should close all files, causing them to be permanently deleted.
2. Find out which application still has the logfile open, and restart only that application.

Which logfiles did you delete anyway?

Groetjes,

Kees-Jan

Cool thanks, never thought of that.

lsof showed me which file it was, it was actually a mysql access log, but not the one that I deleted.

I'm thinking this is a logrotate problem as it's the first time i've set up logrotate and the file was nearly 22gig in size.

I'll do some more searching on logrotate, but meanwhile i'll keep an eye on it.

As a precaution until i find the cause, i'fve set up crom to mail me the output of df -h every day.

Thanks for your help

Tony