From owner-freebsd-questions@FreeBSD.ORG Thu Nov 3 13:00:43 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 37E3516A41F for ; Thu, 3 Nov 2005 13:00:43 +0000 (GMT) (envelope-from o.greve@axis.nl) Received: from yggdrasil.interstroom.nl (yggdrasil.interstroom.nl [80.85.129.11]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6CFFB43D48 for ; Thu, 3 Nov 2005 13:00:42 +0000 (GMT) (envelope-from o.greve@axis.nl) Received: from ip127-180.introweb.nl ([80.65.127.180] helo=[192.168.1.42]) by yggdrasil with asmtp (Exim 3.35 #1 (Debian)) id 1EXehh-0005jU-00 for ; Thu, 03 Nov 2005 14:00:29 +0100 Message-ID: <436A09E9.5070905@axis.nl> Date: Thu, 03 Nov 2005 14:00:25 +0100 From: Olaf Greve User-Agent: Mozilla Thunderbird 1.0.7-1.4.1.centos4 (X11/20051007) X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-MailScanner-Information: Interstroom virusscan, please e-mail helpdesk@interstroom.nl for more information X-MailScanner-SpamCheck: Subject: How to clear an improperly unreferenced file in multi-user mode? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Nov 2005 13:00:43 -0000 Hi, When doing some maintenance on my fall-back server I ran into something weird. When running df it turned out /var was for 90% full. I then manually deleted some files (as root over SSH), amongst which the 'maillog' logfiles in /var/log, I also killed sendmail (as it was generating the big log files, and at present I don't need to run it on that machine), and just to be sure I created a new 'maillog file of 0 length. So far so good, but after removing the maillog files and performing another df call, the available size had not quite dropped as much as expected and as should. DU reports the proper amount of disk usage, so I performed an fsck. On /var it shows: 239511 files, 2365547 used, 4942027 free (37155 frags, 613109 blocks, 0.5% fragmentation) ** /dev/da0s1d (NO WRITE) ** Last Mounted on /var ** Phase 1 - Check Blocks and Sizes ** Phase 2 - Check Pathnames ** Phase 3 - Check Connectivity ** Phase 4 - Check Reference Counts UNREF FILE I=48134 OWNER=root MODE=100640 SIZE=322792549 MTIME=Nov 3 13:46 2005 CLEAR? no Now, of course one way to get rid of that big sucker is to boot the machine in single user mode and run fsck again, however, the box is nowhere near me and I cannot go down to the city where the machine is anytime soon (besides: this is far from an urgent issue). So, I was wondering about a thing: rather than doing a remote reboot and hope that fsck will clear it up in the booting process (if it does that at all, that is), I was wondering if there's a way to fix this when running in multi user mode. Does anyone know how (if possible) to achieve this, or do I have to reboot the machine in single user mode after all? Tnx and cheers, Olafo PS: Will it perhaps be possible to manually unmount /var, then fsck -y it, and then remount it, or will that cause the machine to lock me out (or perform other undesired behaviour)?