[eric343]

My Debian Linux server's hard drive is always full. I noticed this occurring since this weekend; since I was able to successfully run an apt-get dist-upgrade late last week, I'm guessing that it started happening recently.

I cleared a few megs of space; a few days later, it's full again (after changing nothing). Netstat -a shows nothing suspicious, nor does running Ethereal and Ettercap on my laptop (watching all connections into and out of the server) -- so I'm guessing it's not being used as a l33t h4x0r w4r3z dump. /var/log/messages and /var/log/syslog don't show anything interesting...

Also, scr-bx (to re-attach to a BitchX window) and apropos don't seem to work. I'd give some more information about what version of Debian I'm running, but I forgot what command displays that!

(and apropos doesn't work...)

Any suggestions as to what could be filling up my hard drive?

 

[k.ODOMA]

Have you tried running df -k to find out which partition(s) is filling up? That might narrow the search.

 

[eric343]

df -k only shows the root partition...

 

[grinch]

df -h tends to make a bit more sense

 

[k.ODOMA]

Quote:

Originally Posted by eric343 df -k only shows the root partition...

Sorry, df -b {directory} might work better. Eh, I'm not at home so I'm going by memorization here.

 

[eric343]

NAME
df - report filesystem disk space usage

SYNOPSIS
df [OPTION]... [FILE]...

DESCRIPTION
This manual page documents the GNU version of df. df dis?
plays the amount of disk space available on the filesystem
containing each file name argument. If no file name is
given, the space available on all currently mounted
filesystems is shown. Disk space is shown in 1K blocks by
default, unless the environment variable POSIXLY_CORRECT
is set, in which case 512-byte blocks are used.

If an argument is the absolute file name of a disk device
node containing a mounted filesystem, df shows the space
available on that filesystem rather than on the filesystem
containing the device node (which is always the root
filesystem). This version of df cannot show the space
available on unmounted filesystems, because on most kinds
of systems doing so requires very nonportable intimate
knowledge of filesystem structures.

OPTIONS
Show information about the filesystem on which each FILE
resides, or all filesystems by default.

-a, --all
include filesystems having 0 blocks

--block-size=SIZE use SIZE-byte blocks

-h, --human-readable
print sizes in human readable format (e.g., 1K 234M
2G)

-H, --si
likewise, but use powers of 1000 not 1024

-i, --inodes
list inode information instead of block usage

-k, --kilobytes
like --block-size=1024

-l, --local
limit listing to local filesystems

-m, --megabytes
like --block-size=1048576

--no-sync
do not invoke sync before getting usage info
(default)

-P, --portability
use the POSIX output format

--sync invoke sync before getting usage info

-t, --type=TYPE
limit listing to filesystems of type TYPE
-T, --print-type
print filesystem type

-x, --exclude-type=TYPE
limit listing to filesystems not of type TYPE

-v (ignored)

--help display this help and exit

--version
output version information and exit

 

[k.ODOMA]

You could try doing df -h on /var. My first guess is that you have log messages building up somewhere. Maybe a cron job isn't getting run. How exactly is your harddrive partitioned? And what kind of server is it?

 

[wallijonn]

http://www.debianhelp.org/

from their forum: http://www.debianhelp.org/modules.ph...&topic=4250&18
Quote:

First of all, try running "apt-get clean" as root. Apt caches all of the packages it downloads in /var/cache/apt, and this can get large. If this is not the problem, you probably have logfiles or mail spools filling up the disk. Please post the output of "du -h /var", which will show what part of var is taking up the space.

df -h
du
sync. sync. sync.
then start doing cats and greps?

 

[eric343]

I've already run sudo apt-get clean.

What does sync do?

du -h /var says that 1.6G of the 1.6G that /var occupies is in /var/www (the webserver root dir)

So it probably isn't the logs.

 

[Dixie Flatline]

eric343,

First thing is, how is your system partitioned? Do you have separate filesystems for /, /var, /usr, and so forth, or is everything in one giant filesystem mounted at /? "df -k" should show you totals for all mounted filesystems, so if it's only showing the root FS, that implies that you've got everything under / (which is not always a great idea, partly for reasons like this.)

Second, "du" may be a more useful tool for tracking things down than "df". This shows disk usage, rather than disk free. Start in the root directory and run "du -sk * .[A-z]*". This will show you the total space used by each file and directory. (The ".[A-z]*" will show "hidden" files as well, but will leave out the "." and ".." directory entries, which would just confuse matters.)

Now, for each directory that seems to be taking a lot of space, cd into that directory and run "du -sk * .[A-z]*" again. This will show you the breakdown of what's using space under that directory. You can descend through the filesystem this way, finding out where the big files are actually living. Once you know that, you can figure out what to do about them.

PS: "sync" flushes the system's write buffers out to disk, usually to make sure than any changes have been committed before you do something risky. It's not something you really need to run by hand anymore, since system scripts will run it whenever they need to. (Back in the grand old days, it was traditional to sync three times before rebooting a system, just to make sure everything was written. I still do "sync ; sync ; sync ; reboot" myself on occasion, but purely on a superstitious basis.

)

 

[eric343]

Well, overnight the disk usage went from 84% (after clearing out some huge files that were in my webspace) to 63%.

Yay cron jobs...