From owner-freebsd-questions Mon Jun 5 17:14:16 2000 Delivered-To: freebsd-questions@freebsd.org Received: from adsl-63-201-55-220.dsl.snfc21.pacbell.net (adsl-63-201-55-220.dsl.snfc21.pacbell.net [63.201.55.220]) by hub.freebsd.org (Postfix) with ESMTP id A69A237BD65 for ; Mon, 5 Jun 2000 17:14:12 -0700 (PDT) (envelope-from jwg2@adsl-63-201-55-220.dsl.snfc21.pacbell.net) Received: from localhost (jwg2@localhost) by adsl-63-201-55-220.dsl.snfc21.pacbell.net (8.9.3/8.9.3) with ESMTP id RAA06850; Mon, 5 Jun 2000 17:14:24 -0700 (PDT) (envelope-from jwg2@adsl-63-201-55-220.dsl.snfc21.pacbell.net) Date: Mon, 5 Jun 2000 17:14:24 -0700 (PDT) From: Jeff Gray To: freebsd-questions@FreeBSD.ORG Cc: Lowell Gilbert Subject: [freebsd-questions] Re: How not to reboot, was part of df - du leakage (fwd) Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Thanks to you and Troy Settle the problem is resolved and understood. The culprit? A network monitoring program called big brother. Excellent program, never did this before. I took it off the 3.3 box and installed it on another box, running 4.0 and now both boxes have stable file systems for the past few hours. For the record, killed the Big Brother processes and the problem went away after about 30 minutes. Tried it earlier but did not wait long enough. Your post got me thinking I was on the right track. Jeff If you knew *which* files you were after, you wouldn't need the reboot to clear things up. There are a lot of possibilities to look into, but all of them are quite rare. You may have missed something in the du(1) output, you may have been hacked, you may have problems with one of the relevant binaries. I'd still lay money, though, that this is a case of some program holding open a file that's already been rm(1)'d (as could happen in logfile rotation, but quite easily in other ways also) while the program writing to it continues to do hold (and write to) the file handle -- if you rebooted, the file handle would get closed automagically, and the space would be freed up again, and if the problem continued, at least you'd be able to see the file where the data went. 50k per hour *is* a lot of space, but I'm not sure you can conclude much from that fact alone. Good luck. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message