scratch space appears full but I can't find the files
 

Solaris 10

"df -h" reports:
/scratch, size=39G, used=34G, avail=5.2G, capacity=87%

"du -skh /scratch" reports:
1.0G /scratch

This looks to me like df is reporting that there is 34G used in /scratch and du is reporting that there is only 1G used in /scratch. Why the discrepancy? Where is the other 33G?

I am looking to free up space in /scratch but I can only find the 1G of data. Where is the rest?

Earlier today, I had a ~20G file in /scratch and df was reporting the capacity at 95% and 2.2G available. After removing the file, df now reports the above values i.e. 87%, 5.2G. How does this make sense?

-Mike

Hi.

If there's a process running which still has an open file handle for any of the files you've removed, then the space won't be released until the process either dies of closes the file.

If you've got 'lsof' installed, try running 'lsof | grep deleted'. You might get some joy from 'fuser /scratch', but to be honest fuser never works for me. If not, try:

cd /proc
find . -size +18000000000

That should find any processes with files bigger than ~18GB open. The first part of the path from any results is the PID for the process.

Dave

fuser only see files that haven't been unlinked so it won't detect the big "removed" one.

Standard windows answer... Reboot.

If a reboot isn't possible ilikejam's solution will identify the process. If the process can't be killed you can hit the file descriptor directly you will see something like this:
-rw-r–r– 1 webservd webservd 121601722 Apr 6 12:36 935/fd/19

935 is the process, 19 is the file descriptor
cd to the /proc/935/fd directory (or whatever is appropriate) and then :>19 (or what your number was) to zero out the file

There are all kinds of warnings against doing it this way I would advice restarting the process as the best way.

A reboot worked!
Thanks for the suggestions!