From owner-freebsd-questions@FreeBSD.ORG  Tue May  4 08:40:38 2010
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 7272C1065672
	for <freebsd-questions@freebsd.org>;
	Tue,  4 May 2010 08:40:38 +0000 (UTC)
	(envelope-from perryh@pluto.rain.com)
Received: from agora.rdrop.com (agora.rdrop.com [199.26.172.34])
	by mx1.freebsd.org (Postfix) with ESMTP id 505B78FC23
	for <freebsd-questions@freebsd.org>;
	Tue,  4 May 2010 08:40:37 +0000 (UTC)
Received: from agora.rdrop.com (66@localhost [127.0.0.1])
	by agora.rdrop.com (8.13.1/8.12.7) with ESMTP id o448eb27065452
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Tue, 4 May 2010 01:40:37 -0700 (PDT)
	(envelope-from perryh@pluto.rain.com)
Received: (from uucp@localhost)
	by agora.rdrop.com (8.13.1/8.12.9/Submit) with UUCP id o448ebGw065451; 
	Tue, 4 May 2010 01:40:37 -0700 (PDT)
Received: from fbsd61 by pluto.rain.com (4.1/SMI-4.1-pluto-M2060407)
	id AA04795; Tue, 4 May 10 01:37:10 PDT
Date: Tue, 04 May 2010 01:35:24 -0700
From: perryh@pluto.rain.com
To: antoniok.spb@gmail.com
Message-Id: <4bdfdc4c.7uW1NWZG0Ilec22I%perryh@pluto.rain.com>
References: <x2z3f1c29e71005032304rf7190596o7dcf0b5dd8be0bc3@mail.gmail.com>
In-Reply-To: <x2z3f1c29e71005032304rf7190596o7dcf0b5dd8be0bc3@mail.gmail.com>
User-Agent: nail 11.25 7/29/05
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: freebsd-questions@freebsd.org
Subject: Re: Strange diskspace loss
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 04 May 2010 08:40:38 -0000

<antoniok.spb@gmail.com> wrote:

> And the fsck:
>
> # fsck
...
> ** /dev/aacdu0s1e (NO WRITE)
> ** Last Mounted on /var
> ** Phase 1 - Check Blocks and Sizes
> ** Phase 2 - Check Pathnames
> ** Phase 3 - Check Connectivity
> ** Phase 4 - Check Reference Counts
> UNREF FILE I=23587  OWNER=root
> MODE=100644
> SIZE=0 MTIME=Apr  9 13:36
> 2010
> CLEAR?
> no
>
> UNREF FILE I=3156011  OWNER=root MODE=100644
> SIZE=6944766 MTIME=May  4 04:34 2010
> CLEAR? no
>
> UNREF FILE I=3179521  OWNER=www MODE=100644
> SIZE=30361665474 MTIME=May  4 09:43 2010
  ^^^^^^^^^^^^^^^^
> CLEAR? no

There's at least part of your problem:  30GB that du can't see
because it isn't linked to by any directory entry.  Something
associated with your web server has created a large scratch file,
which it still has open (and thus the space can't be reclaimed),
but it unlinked the file after creating it so that it would
automatically go away once the process dies.

This sort of thing -- though seldom so large as this -- is not at
all uncommon in /tmp.  It's less common, but (as in this case) not
unheard of, in /var/tmp.