Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 05 Nov 2012 17:27:09 -0500
From:      Lowell Gilbert <>
To:        Eugen Konkov <>
Cc:        FreeBSD Questions <>
Subject:   Re: HELP: some process eat my /var
Message-ID:  <>
In-Reply-To: <> (Eugen Konkov's message of "Mon, 5 Nov 2012 23:01:17 +0200")
References:  <> <> <> <> <> <>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
Eugen Konkov <> writes:

> =A7=A9=A7=D5=A7=E2=A7=D1=A7=D3=A7=E3=A7=E4=A7=D3=A7=E5=A7=DB=A7=E4=A7=D6,=
> =A7=A3=A7=ED =A7=E1=A7=DA=A7=E3=A7=D1=A7=DD=A7=DA 5 =A7=DF=A7=E0=A7=F1=A7=
=D2=A7=E2=A7=F1 2012 =A7=D4., 12:38:47:
> VH> Its possible that a process is holding open an unlinked file (some
> VH> processes do this for tmp files as they are automatically deleted if =
> VH> program exit, I believe mysql does it for tmp tables for example)
> VH> I've had this happen when a log got rotated but the process wasnt
> VH> notified so it kept writing to the file.
> VH> I believe lsof +L1  will show unlinked but open files.
> it shows nothing ((

Not surprising; I think you had already covered that possibility with
fstat(1). It's vaguely possible that the space is used in large files
that are "covered" by the dev filesystem mounted in named's chroot, but
I think it's more likely you have some filesystem corruption.

Have you tried an fsck(8)? As usual, you would want good backups first,
and then rebooting to single-user mode so you can fsck the filesystem
without it being mounted.

Good luck.

Want to link to this message? Use this URL: <>