From owner-freebsd-questions@FreeBSD.ORG Mon Nov 5 22:27:19 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 1F952A71 for ; Mon, 5 Nov 2012 22:27:19 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: from asbnvacz-mailrelay01.megapath.net (asbnvacz-mailrelay01.megapath.net [207.145.128.243]) by mx1.freebsd.org (Postfix) with ESMTP id D88B98FC08 for ; Mon, 5 Nov 2012 22:27:18 +0000 (UTC) Received: from mail5.sea5.speakeasy.net (mail5.sea5.speakeasy.net [69.17.117.49]) by asbnvacz-mailrelay01.megapath.net (Postfix) with ESMTP id 1B029A70A64 for ; Mon, 5 Nov 2012 17:27:12 -0500 (EST) Received: (qmail 18331 invoked from network); 5 Nov 2012 22:27:11 -0000 Received: by simscan 1.4.0 ppid: 22914, pid: 5219, t: 0.2684s scanners: clamav: 0.88.2/m:52/d:10739 Received: from unknown (HELO be-well.ilk.org) ([66.92.78.145]) (envelope-sender ) by mail5.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 5 Nov 2012 22:27:11 -0000 Received: by be-well.ilk.org (Postfix, from userid 1147) id 0E4AB33C32; Mon, 5 Nov 2012 17:27:10 -0500 (EST) From: Lowell Gilbert To: Eugen Konkov Subject: Re: HELP: some process eat my /var References: <1397755241.20121102210553@yandex.ru> <5094847D.5000904@dreamchaser.org> <20628.35101.903869.363056@jerusalem.litteratus.org> <1314272547.20121105113245@yandex.ru> <50979737.9080106@unsane.co.uk> <568009110.20121105230117@yandex.ru> Date: Mon, 05 Nov 2012 17:27:09 -0500 In-Reply-To: <568009110.20121105230117@yandex.ru> (Eugen Konkov's message of "Mon, 5 Nov 2012 23:01:17 +0200") Message-ID: <44zk2vptxe.fsf@be-well.ilk.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.2 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=gb2312 Content-Transfer-Encoding: quoted-printable Cc: FreeBSD Questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: FreeBSD Questions List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Nov 2012 22:27:19 -0000 Eugen Konkov writes: > =A7=A9=A7=D5=A7=E2=A7=D1=A7=D3=A7=E3=A7=E4=A7=D3=A7=E5=A7=DB=A7=E4=A7=D6,= Vincent. > > =A7=A3=A7=ED =A7=E1=A7=DA=A7=E3=A7=D1=A7=DD=A7=DA 5 =A7=DF=A7=E0=A7=F1=A7= =D2=A7=E2=A7=F1 2012 =A7=D4., 12:38:47: >>> > VH> Its possible that a process is holding open an unlinked file (some > VH> processes do this for tmp files as they are automatically deleted if = the > VH> program exit, I believe mysql does it for tmp tables for example) > VH> I've had this happen when a log got rotated but the process wasnt > VH> notified so it kept writing to the file. > VH> I believe lsof +L1 will show unlinked but open files. > > it shows nothing (( Not surprising; I think you had already covered that possibility with fstat(1). It's vaguely possible that the space is used in large files that are "covered" by the dev filesystem mounted in named's chroot, but I think it's more likely you have some filesystem corruption. Have you tried an fsck(8)? As usual, you would want good backups first, and then rebooting to single-user mode so you can fsck the filesystem without it being mounted. Good luck.