From owner-freebsd-questions@FreeBSD.ORG  Fri Nov  2 19:36:00 2012
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 5F646E3F
 for <freebsd-questions@freebsd.org>; Fri,  2 Nov 2012 19:36:00 +0000 (UTC)
 (envelope-from freebsd-questions@m.gmane.org)
Received: from plane.gmane.org (plane.gmane.org [80.91.229.3])
 by mx1.freebsd.org (Postfix) with ESMTP id 100B18FC0A
 for <freebsd-questions@freebsd.org>; Fri,  2 Nov 2012 19:35:59 +0000 (UTC)
Received: from list by plane.gmane.org with local (Exim 4.69)
 (envelope-from <freebsd-questions@m.gmane.org>) id 1TUN26-00056A-HY
 for freebsd-questions@freebsd.org; Fri, 02 Nov 2012 20:35:58 +0100
Received: from pool-173-79-84-117.washdc.fios.verizon.net ([173.79.84.117])
 by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
 id 1AlnuQ-0007hv-00
 for <freebsd-questions@freebsd.org>; Fri, 02 Nov 2012 20:35:58 +0100
Received: from nightrecon by pool-173-79-84-117.washdc.fios.verizon.net with
 local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00
 for <freebsd-questions@freebsd.org>; Fri, 02 Nov 2012 20:35:58 +0100
X-Injected-Via-Gmane: http://gmane.org/
To: freebsd-questions@freebsd.org
From: Michael Powell <nightrecon@hotmail.com>
Subject: Re: HELP: some process eat my /var
Date: Fri, 02 Nov 2012 15:35:41 -0400
Lines: 21
Message-ID: <k717a8$s0e$1@ger.gmane.org>
References: <1397755241.20121102210553@yandex.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7Bit
X-Complaints-To: usenet@ger.gmane.org
X-Gmane-NNTP-Posting-Host: pool-173-79-84-117.washdc.fios.verizon.net
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
Reply-To: nightrecon@hotmail.com
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Nov 2012 19:36:00 -0000

Eugen Konkov wrote:

> 
> how to find which process take space?
> 
> 
You might want to look at fstat and lsof. fstat is in system while lsof is 
an add-on third party port. Keep in mind that when you do find the space you 
are looking for it will be held 'open' as an open file in the file system as 
long as the process is running. During normal operations you can shut down 
the process and release the space so it can be deleted. This is relatively 
straightforward as long as everything is 'normal'. The more difficult 
position arises when a process has behaved abnormally, including going 
zombie, crashing, etc. With the 'abnormal' there can be a chance that even 
though the process is gone you may encounter difficulty trying to 
delete/recover the space because the file system still considers it an open 
file.

-Mike