1

This morning I was greeted with low disk warning on my root partition. So I started with usual investigation path and obviously the result of my first command become the one as shown below.

[root@my-server /]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda3              97G   86G  6.0G  94% /
tmpfs                  12G  5.7G  6.1G  48% /dev/shm
/dev/sda2             360G   16G  326G   5% /www
/dev/sdb1             458G   38G  397G   9% /web
/dev/sdc1             458G   42G  393G  10% /server
/dev/sdd1             458G   44G  392G  10% /mysql
[root@my-server /]# df -i
Filesystem            Inodes   IUsed   IFree IUse% Mounted on
/dev/sda3            6406144  264687 6141457    5% /
tmpfs                3070273     175 3070098    1% /dev/shm
/dev/sda2            23928832    1373 23927459    1% /www
/dev/sdb1            30457856   52061 30405795    1% /web
/dev/sdc1            30457856    1995 30455861    1% /server
/dev/sdd1            30457856     793 30457063    1% /MySQL

But I wanted to know who is taking that much space and fired up disk usage and found,

[root@my-server /]# du -shx /
24G /
[root@my-server /]# du -h --max-depth=1 /
1.6G /root
4.0G /home
14M /sbin
6.5G /var
0 /misc
12K /.dbus
4.0K /mnt
4.0K /media
5.7G /dev
4.8G /opt
0 /sys
52M /user
35M /etc
0 /net
4.0K /bak
43G /mysql
6.5G /usr
du: cannot access `/proc/3633/task/25117/fd/78': No such file or directory
du: cannot access `/proc/3633/task/7047/fd/70': No such file or directory
du: cannot access `/proc/24882/task/24882/fd/4': No such file or directory
du: cannot access `/proc/24882/task/24882/fdinfo/4': No such file or directory
du: cannot access `/proc/24882/fd/4': No such file or directory
du: cannot access `/proc/24882/fdinfo/4': No such file or directory
du: cannot access `/proc/24883': No such file or directory
0 /proc
244M /lib
4.0K /nas
4.0K /selinux
4.0K /srv
27M /lib64
42G /server
49M /boot
16G /www
16K /lost+found
38G /web
100M /tmp
8.9M /bin
168G /

whoops, the actual usage being around 30GB, how do I find what files are eating my disk?

Confirming to the suspicion the culprit was a deleted file, Nothing like find or du could resolve the offending file if the file doesn't exists! well, te actual sequence of actions to find it were,

[root@my-server ~]# lsof / | grep deleted
...
java  3633  wwwuser  1w  REG  8,3  66975347588  396715  /home/wwwuser/apache-tomcat-7.0.29/logs/catalina.out (deleted)
...

whoops, a 62GB file, now,

[root@my-server ~]# cd /proc/3633/fd/
[root@my-server fd]# ll | grep deleted
[root@my-server fd]# > 1

Well, the above commands I figured out from another SO answer at https://stackoverflow.com/questions/17860257/unable-to-find-large-files-in-linux-using-du-h but I was wondering wat was that last command? How did it reclaim the orphan disk space?

Community
  • 1
Jimson James
  • 429
  • 7
  • 10
  • 6
    Deleted files that are still in use. – Michael Hampton Oct 07 '13 at 17:32
  • Could also be files written into one of the mount point folders before the partition was mounted, but that shouldn't suddenly happen while the system is running to cause an alert. Deleted file is more likely, probably log rotation gone wrong. – DerfK Oct 07 '13 at 17:46
  • deleted files... might be the case, need to check with lsof. Also, yes; log rotation is there and is the suspected culprit for now. – Jimson James Oct 07 '13 at 17:52

3 Answers3

3

My favorite command for locating what's taking up space is this:

$ du -sh ./*

When you run the disk used command with these options it displays the sizes of the files and folders in that folder. for folders, the size includes the size of all of the contents as well. This makes it super easy to see at a glance where your space it getting used up.

Protip: If this is a command you want to be running frequently, you can make an alias for it in your ~/.bashrc file like this:

alias showdisk='du -sh ./*'

Now the next time you load up your terminal you'll be type $ showdisk and it will display the sizes of the files and folders in the folder you are in on the command line. Hopefully this helps speed things up for you :D

innovati
  • 131
  • 2
2

I like this tool:

http://dev.yorhel.nl/ncdu

It is basically a ncurses gui wrapper for du. I find it to be a little more helpful than a plain du, since it performs all the work at the same time, instead of each time you enter the directory with the highest utilization. It can be especially helpful on disk trees with a lot of data in them.

joshc
  • 21
  • 2
0

I always use this simple script which will u print the files what are big

find /var/log -type f -size +3G -exec ls -lh {} \; | awk '{ print $5 ": " $9 }' | sort -rh

but in case there is folder which contain plenty of small files i always use

du -sh folder

or

du -hsx /* | sort -rh | head -10

to find duplicates files, first by size then md5sume

find -not -empty -type f -printf "%s\n" | sort -rn | uniq -d | xargs -I{} -n1 find -type f -size {}c -print0 | xargs -0 md5sum | sort | uniq -w32 --all-repeated=separate
nonus25
  • 261
  • 1
  • 4
  • 9