Solved

/root direcotory is full

Posted on 2008-10-07
30
555 Views
Last Modified: 2013-12-06
HI today i realized my produciton server's root direcotry is full

but if i  do du-sh it only show 67M, but from df -h you an see it takes 1012 M!! what makes my /root full ??

[root@xxx~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/cciss/c0d0p9    1012M 1012M     0 100% /
/dev/cciss/c0d0p1     122M   39M   77M  34% /boot


then cd /root
[root@xxx~]# du -sh
67M  

then :

[root@xxx~]# du -h /root
132K    /root/.nautilus/metafiles
140K    /root/.nautilus
30M     /root/.Trash
4.0K    /root/.kde/share/services
4.0K    /root/.kde/share/mimelnk
4.0K    /root/.kde/share/apps/kmail/search
4.0K    /root/.kde/share/apps/kmail/imap
4.0K    /root/.kde/share/apps/kmail/dimap
20K     /root/.kde/share/apps/kmail
4.0K    /root/.kde/share/apps/kcookiejar
32K     /root/.kde/share/apps/kconf_update
16K     /root/.kde/share/apps/konqueror
4.0K    /root/.kde/share/apps/kfm/bookmarks
8.0K    /root/.kde/share/apps/kfm
4.0K    /root/.kde/share/apps/khtml
88K     /root/.kde/share/apps
4.0K    /root/.kde/share/servicetypes
4.0K    /root/.kde/share/config/session
252K    /root/.kde/share/config
4.0K    /root/.kde/share/applnk
4.0K    /root/.kde/share/locale
364K    /root/.kde/share
368K    /root/.kde
592K    /root/.mcop/trader-cache
600K    /root/.mcop
316K    /root/.metacity/sessions
324K    /root/.metacity
16K     /root/.elinks
36K     /root/bin
8.0K    /root/.gconf/apps/procman/proctree
8.0K    /root/.gconf/apps/procman/disktreenew
24K     /root/.gconf/apps/procman
8.0K    /root/.gconf/apps/file-roller/dialogs/extract
12K     /root/.gconf/apps/file-roller/dialogs
8.0K    /root/.gconf/apps/file-roller/general
8.0K    /root/.gconf/apps/file-roller/listing
32K     /root/.gconf/apps/file-roller
12K     /root/.gconf/apps/nautilus
8.0K    /root/.gconf/apps/ggv/layout
12K     /root/.gconf/apps/ggv
8.0K    /root/.gconf/apps/gedit-2/preferences/ui/open_save
12K     /root/.gconf/apps/gedit-2/preferences/ui
16K     /root/.gconf/apps/gedit-2/preferences
20K     /root/.gconf/apps/gedit-2
16K     /root/.gconf/apps/panel/objects/wordprocessor_launcher
16K     /root/.gconf/apps/panel/objects/presentation_launcher
16K     /root/.gconf/apps/panel/objects/spreadsheet_launcher
16K     /root/.gconf/apps/panel/objects/email_launcher
16K     /root/.gconf/apps/panel/objects/web_launcher
92K     /root/.gconf/apps/panel/objects
12K     /root/.gconf/apps/panel/toplevels/bottom_panel
24K     /root/.gconf/apps/panel/toplevels
16K     /root/.gconf/apps/panel/general
12K     /root/.gconf/apps/panel/applets/clock/prefs
24K     /root/.gconf/apps/panel/applets/clock
12K     /root/.gconf/apps/panel/applets/window_list/prefs
24K     /root/.gconf/apps/panel/applets/window_list
12K     /root/.gconf/apps/panel/applets/mixer/prefs
24K     /root/.gconf/apps/panel/applets/mixer
12K     /root/.gconf/apps/panel/applets/workspace_switcher/prefs
24K     /root/.gconf/apps/panel/applets/workspace_switcher
108K    /root/.gconf/apps/panel/applets
252K    /root/.gconf/apps/panel
8.0K    /root/.gconf/apps/gnome-settings/gedit
16K     /root/.gconf/apps/gnome-settings/gnome-nettool
12K     /root/.gconf/apps/gnome-settings/gnome-search-tool
48K     /root/.gconf/apps/gnome-settings
12K     /root/.gconf/apps/gnome-search-tool/select
24K     /root/.gconf/apps/gnome-search-tool
436K    /root/.gconf/apps
12K     /root/.gconf/desktop/gnome/applications/window_manager
24K     /root/.gconf/desktop/gnome/applications
16K     /root/.gconf/desktop/gnome/file_views
8.0K    /root/.gconf/desktop/gnome/accessibility/keyboard
12K     /root/.gconf/desktop/gnome/accessibility
16K     /root/.gconf/desktop/gnome/background
12K     /root/.gconf/desktop/gnome/peripherals/keyboard/xkb.sysbackup
16K     /root/.gconf/desktop/gnome/peripherals/keyboard/xkb
40K     /root/.gconf/desktop/gnome/peripherals/keyboard
52K     /root/.gconf/desktop/gnome/peripherals
132K    /root/.gconf/desktop/gnome
144K    /root/.gconf/desktop
588K    /root/.gconf
8.0K    /root/Desktop
8.0K    /root/.xcdroast
4.0K    /root/.qt
4.0K    /root/.rhopenoffice1.1/user/template
20K     /root/.rhopenoffice1.1/user/gallery
16K     /root/.rhopenoffice1.1/user/basic/Standard
28K     /root/.rhopenoffice1.1/user/basic
8.0K    /root/.rhopenoffice1.1/user/autotext
4.0K    /root/.rhopenoffice1.1/user/store
4.0K    /root/.rhopenoffice1.1/user/wordbook
4.0K    /root/.rhopenoffice1.1/user/temp
492K    /root/.rhopenoffice1.1/user/registry/cache
24K     /root/.rhopenoffice1.1/user/registry/data/org/openoffice/Office
36K     /root/.rhopenoffice1.1/user/registry/data/org/openoffice
40K     /root/.rhopenoffice1.1/user/registry/data/org
44K     /root/.rhopenoffice1.1/user/registry/data
540K    /root/.rhopenoffice1.1/user/registry
4.0K    /root/.rhopenoffice1.1/user/psprint/driver
4.0K    /root/.rhopenoffice1.1/user/psprint/fontmetric
40K     /root/.rhopenoffice1.1/user/psprint
4.0K    /root/.rhopenoffice1.1/user/plugin
596K    /root/.rhopenoffice1.1/user/config
4.0K    /root/.rhopenoffice1.1/user/uno_packages
4.0K    /root/.rhopenoffice1.1/user/backup
4.0K    /root/.rhopenoffice1.1/user/autocorr
68K     /root/.rhopenoffice1.1/user/database/biblio
72K     /root/.rhopenoffice1.1/user/database
1.4M    /root/.rhopenoffice1.1/user
4.0K    /root/.rhopenoffice1.1/share/dict/ooo
8.0K    /root/.rhopenoffice1.1/share/dict
4.0K    /root/.rhopenoffice1.1/share/uno_packages
4.0K    /root/.rhopenoffice1.1/share/autocorr
4.0K    /root/.rhopenoffice1.1/share/samples/english
8.0K    /root/.rhopenoffice1.1/share/samples
28K     /root/.rhopenoffice1.1/share
4.0K    /root/.rhopenoffice1.1/program/addin
8.0K    /root/.rhopenoffice1.1/program
2.1M    /root/.rhopenoffice1.1
8.0K    /root/.gnome2_private
12K     /root/.gstreamer-0.8
24K     /root/.mozilla/firefox/gx23i8pm.default/chrome
4.0K    /root/.mozilla/firefox/gx23i8pm.default/Cache.Trash
24K     /root/.mozilla/firefox/gx23i8pm.default/extensions
16K     /root/.mozilla/firefox/gx23i8pm.default/US
8.0K    /root/.mozilla/firefox/gx23i8pm.default/bookmarkbackups
29M     /root/.mozilla/firefox/gx23i8pm.default/Cache
30M     /root/.mozilla/firefox/gx23i8pm.default
31M     /root/.mozilla/firefox
31M     /root/.mozilla
48K     /root/.config/menus
56K     /root/.config
12K     /root/.vmware
8.0K    /root/.eggcups
20K     /root/.vnc
32K     /root/.ssh
4.0K    /root/vmware
4.0K    /root/Mail/inbox/cur
4.0K    /root/Mail/inbox/new
4.0K    /root/Mail/inbox/tmp
16K     /root/Mail/inbox
4.0K    /root/Mail/sent-mail/cur
4.0K    /root/Mail/sent-mail/new
4.0K    /root/Mail/sent-mail/tmp
16K     /root/Mail/sent-mail
4.0K    /root/Mail/outbox/cur
4.0K    /root/Mail/outbox/new
4.0K    /root/Mail/outbox/tmp
16K     /root/Mail/outbox
4.0K    /root/Mail/trash/cur
4.0K    /root/Mail/trash/new
4.0K    /root/Mail/trash/tmp
16K     /root/Mail/trash
4.0K    /root/Mail/drafts/cur
4.0K    /root/Mail/drafts/new
4.0K    /root/Mail/drafts/tmp
16K     /root/Mail/drafts
124K    /root/Mail
16K     /root/.gnome2/share/fonts
16K     /root/.gnome2/share/cursor-fonts
40K     /root/.gnome2/share
8.0K    /root/.gnome2/keyrings
4.0K    /root/.gnome2/file-roller
32K     /root/.gnome2/accels
8.0K    /root/.gnome2/nautilus-scripts
52K     /root/.gnome2/panel2.d/default/launchers
60K     /root/.gnome2/panel2.d/default
68K     /root/.gnome2/panel2.d
208K    /root/.gnome2
8.0K    /root/.gconfd
1.3M    /root/.thumbnails/fail/gnome-thumbnail-factory
1.3M    /root/.thumbnails/fail
176K    /root/.thumbnails/normal
1.5M    /root/.thumbnails
8.0K    /root/tmp
16K     /root/.borland
8.0K    /root/.gnome/mime-info
4.0K    /root/.gnome/application-info
16K     /root/.gnome/gnome-vfs
36K     /root/.gnome
67M     /root
[root@beaver ~]# du -sh *
36K     bin
0       date_marker
4.0K    dead.letter
8.0K    Desktop
124K    Mail
4.0K    mbox
8.0K    openvpn-status.log
8.0K    tmp
4.0K    vmware


Extra note : if root gets to many emails will it fill /root partition ??

please help me to solve this problem
0
Comment
Question by:fosiul01
  • 11
  • 11
  • 5
  • +1
30 Comments
 
LVL 19

Expert Comment

by:jools
ID: 22661691
fusiul01, you are confusing the directory /root (the home directory for the root userid) and the real root directory "/".

What have you installed and are all your file systems mounted?
0
 
LVL 40

Expert Comment

by:omarfarid
ID: 22661708
run

du -k / | sort -r

this will give you size in KB, sorted by size

0
 
LVL 29

Author Comment

by:fosiul01
ID: 22661709
HI thank
no i didnot install nothing from last 1 year!!

[root@xx~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/cciss/c0d0p9    1012M 1012M     0 100% /
/dev/cciss/c0d0p1     122M   39M   77M  34% /boot
/dev/cciss/c0d0p2      73G  7.1G   62G  11% /bv8
none                 1014M     0 1014M   0% /dev/shm
/dev/cciss/c0d0p5     9.9G  667M  8.7G   7% /home
/dev/cciss/c0d0p8    1012M   34M  927M   4% /tmp
/dev/cciss/c0d0p6     9.9G  5.5G  3.9G  59% /usr
/dev/cciss/c0d0p3      35G   21G   13G  62% /var
[root@xxx~]#
0
 
LVL 40

Expert Comment

by:omarfarid
ID: 22661711
or

du -k / | sort -nr
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22661740
du -k / | sort -r , its giving me to many files such as form this direcotry as well /usr
is that right ??
0
 
LVL 19

Accepted Solution

by:
http:// thevpn.guru earned 350 total points
ID: 22661744
As said above start out with

du -sh /*

This should give you the directory using the space..should be var or usr from my expectations.
0
 
LVL 19

Expert Comment

by:jools
ID: 22661757
Actually 67M out of 1012 is quite high...

Have you tried housekeeping your firefox settings.
> 29M     /root/.mozilla/firefox/gx23i8pm.default/Cache
> 30M     /root/.mozilla/firefox/gx23i8pm.default
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22661765
here is du-sh /*

[root@beaver ~]# du -sh /*
0       /backuplog010908
0       /backuplog011008
8.5M    /backuplog020908
0       /backuplog021008
8.5M    /backuplog030908
0       /backuplog031008
8.5M    /backuplog040908
8.6M    /backuplog050908
8.4M    /backuplog060808
0       /backuplog061008
8.5M    /backuplog070808
8.5M    /backuplog080808
8.6M    /backuplog080908
8.6M    /backuplog090908
8.6M    /backuplog100908
8.5M    /backuplog110808
8.6M    /backuplog110908
8.5M    /backuplog120808
8.6M    /backuplog120908
8.5M    /backuplog130808
8.5M    /backuplog140808
8.5M    /backuplog150808
8.5M    /backuplog150908
8.5M    /backuplog160908
8.5M    /backuplog170908
8.5M    /backuplog180808
8.5M    /backuplog180908
8.5M    /backuplog190808
8.6M    /backuplog190908
8.5M    /backuplog200808
0       /backuplog210808
8.5M    /backuplog220808
8.6M    /backuplog220908
8.6M    /backuplog230908
4.4M    /backuplog240908
0       /backuplog250808
4.0K    /backuplog250908
8.5M    /backuplog260808
4.0K    /backuplog260908
8.5M    /backuplog270808
8.5M    /backuplog280808
8.5M    /backuplog290808
4.0K    /backuplog290908
0       /backuplog300908
6.4M    /bin
34M     /boot
0
 
LVL 19

Expert Comment

by:jools
ID: 22661770
I guess in this case your /root was filling up / (root)....
there must be a unix joke in there somewhere...
0
 
LVL 19

Expert Comment

by:jools
ID: 22661782
then again.....Just seen the last post....

Does anything strike you as being large there?
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22661794
HOw come all the backup log

0       /backuplog010908
0       /backuplog011008
8.5M    /backuplog020908

is those in root directory ??

[root@beaver ~]# locate ackuplog020908
/backuplog020908
0
 
LVL 19

Expert Comment

by:jools
ID: 22661795
... sorry finger trouble...

What is creating the backuplog files/directories?
0
 
LVL 19

Expert Comment

by:http:// thevpn.guru
ID: 22661801
Try

rm -rf /backuplog*

then try df -h
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22661815
hahahahahahahaahhahaahahah
God!!!

rm -rf /backuplog*

now its like this :

[root@beaver ~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/cciss/c0d0p9    1012M  736M  225M  77% /
/dev/cciss/c0d0p1     122M   39M   77M  34% /boot
/dev/cciss/c0d0p2      73G  7.1G   62G  11% /bv8
none                 1014M     0 1014M   0% /dev/shm
/dev/cciss/c0d0p5     9.9G  667M  8.7G   7% /home
/dev/cciss/c0d0p8    1012M   34M  927M   4% /tmp
/dev/cciss/c0d0p6     9.9G  5.5G  3.9G  59% /usr
/dev/cciss/c0d0p3      35G   21G   13G  62% /var


0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 19

Expert Comment

by:http:// thevpn.guru
ID: 22661832
Great :) ...now we need to know what application is writting those logs there and have them written to /var/logs/ or you have to remove them daily :)
0
 
LVL 19

Expert Comment

by:jools
ID: 22661834
OK, but something must be creating the backup logs in the first place, you need to find out what it is or you will be doing the same in 736/8.5M days time!
0
 
LVL 19

Expert Comment

by:jools
ID: 22661846
oops, there is an echo, sorry.... I'll leave well alone :-)
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22661848
yes, but how will i know ??


I didnot configure this server, its previous IT guy he did

0
 
LVL 19

Expert Comment

by:jools
ID: 22661863
look in crontab for scheduled jobs
0
 
LVL 19

Expert Comment

by:http:// thevpn.guru
ID: 22661878
hmm....there are methods..you could use auditd...or simpler

lsof | grep backuplog

However the latter command only works while the backup is running...however since the backups are periodic..you might want to check the crontab first for backup jobs.
0
 
LVL 19

Expert Comment

by:http:// thevpn.guru
ID: 22661916
Jools this time I was your echo :)
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22661921
ok i will check those tomorrow, as far i know 2 backups run every night

which do full backup then write to a tap drive thats all

just tel me

0       /backuplog010908


if i want to see this backuplog010908 log , how will i see this ??
if i can check those then i would of know what creating those logs

cat /backuplog010908 ??
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22661925
what is echo ?? didnot understand!!
0
 
LVL 19

Assisted Solution

by:jools
jools earned 150 total points
ID: 22664627
shakoush2001:
   <grin>

fosiul01:
   Dont worry about the `echo` it's just a bit of light banter.

You need to find the script that creates the backup logs. You can see what jobs are scheduled by using crontab -l OR you may need to look in the cron directories.

Below is a slightly edited list of cron files on my system,

# ls -al /etc/cron*
-rw-r--r-- 1 root root    0 Jun 16 21:52 /etc/cron.deny
-rw-r--r-- 1 root root  255 Jan  6  2007 /etc/crontab

/etc/cron.d:
-rw-r--r--   1 root root   139 Jan  9  2007 mrtg
-rw-------   1 root root   366 May 24 17:54 sa-update
-rw-r--r--   1 root root   188 May 24 16:47 sysstat

/etc/cron.daily:
-rwxr-xr-x   1 root root   133 Jan  9  2007 00webalizer
-rwxr-xr-x   1 root root   379 Mar 28  2007 0anacron
lrwxrwxrwx   1 root root    39 Jul  7 22:35 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl
-rwxr-xr-x   1 root root  1042 May 24 18:30 certwatch
-rwxr-xr-x   1 root root   118 Jun 22 02:53 cups
-rwxr-xr-x   1 root root   180 Dec  2  2007 logrotate
-rwxr-xr-x   1 root root   418 Jan  6  2007 makewhatis.cron
-rwxr-xr-x   1 root root   137 Mar 14  2007 mlocate.cron
-rwxr-xr-x   1 root root  2181 Jun 21  2006 prelink
-rwxr-xr-x   1 root root   114 May 24 19:44 rpm
-rwxr-xr-x   1 root root   271 Nov 18  2007 squirrelmail.cron
-rwxr-xr-x   1 root root   290 Mar 15  2007 tmpwatch

/etc/cron.hourly:

/etc/cron.monthly:
-rwxr-xr-x   1 root root   381 Mar 28  2007 0anacron

/etc/cron.weekly:
-rwxr-xr-x   1 root root   380 Mar 28  2007 0anacron
-rwxr-xr-x   1 root root   414 Jan  6  2007 makewhatis.cron

cron is controlled by the crontab file

# more /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

From the (run-parts) section above, the scripts in cron.hourly are run every minute past the hour, the scripts in cron.daily are run a 04:02am every day etc etc.

You may have a job scheduled in the crontab file directly or possibly in one of the cron.* directories. This will be the name of the script that runs your backup. You *may* also have to look at the backup script and modify it to change the location of the backup log.

Hint: scripting a backup job to chuck the backup log in the root directory is not the best idea.

If you go with the shakoush2001's suggestion above for putting it in /var/log (as good a place as any!!) then you will need to check the logs and do your own housekeeping or configuring logrotate to do it for you.


.. yes... cat will display the backup log on screen...

toodle pip!


0
 
LVL 29

Author Comment

by:fosiul01
ID: 22667254
HI jools thanks

i just want one more clarification then i will close this questioin

you said in your first comments : fusiul01, you are confusing the directory /root (the home directory for the root userid) and the real root directory "/".

i received 2 email every day from server subject is from Logwatch

in one email it say : Disk space
  /dev/sda8          35G   6.6G  27G  20%    /


and anohtr one  

Disk Space

Filesystem            Size  Used Avail Use% Mounted on
/dev/cciss/c0d0p9    1012M  736M  225M  77% /

both both is comming from Same Server!!!

then why this difference ??
0
 
LVL 19

Expert Comment

by:jools
ID: 22667326
They are not both from the same server, one is 35G on sda8, the other is 1G on c0d0p9.

Check the headers of the email, post back here
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22667346
hahaha so sorry!! its another server.

i didnot think, i am receiving email from another server

this server actually places in DMZ , i didnothink , previous IT guy will configure this server to sendmail via logwatch

just explain me this one :

you said in your first comments : fusiul01, you are confusing the directory /root (the home directory for the root userid) and the real root directory "/".


/dev/cciss/c0d0p9    1012M  736M  225M  77% /  : is this home for root user or its root directory ??
0
 
LVL 19

Expert Comment

by:jools
ID: 22667432
/ is the real root directory. Under this there is a "root" directory (/root) which is the home directory for the root user.

You said that /root was saying 67M used but when you did the df is said 1012MB. The difference being that df reported the file system size for the real root directory (/) and du reported the size of the root users home directory.

Later in the thread, omar and shakoush suggested doing the du on / which showed up the size of the backup log files in root (yes, the real root). Now I may add to the confusion here if I say that /root is under / (df -k /; df -k /root).

Now, hopefully, you have found the script that creates the backup log files and either changed it to log somewhere else or have a procedure in place to check the logs and do manual housekeeping.

Not a bad team effort really :-)
0
 
LVL 29

Author Comment

by:fosiul01
ID: 22667484
thats why i like this EE , good team work always.

i will ask few more question on this issue on new one, its not fair to ask all the question in one.

Thanks for the help
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Suggested Solutions

Linux users are sometimes dumbfounded by the severe lack of documentation on a topic. Sometimes, the documentation is copious, but other times, you end up with some obscure "it varies depending on your distribution" over and over when searching for …
1. Introduction As many people are interested in Linux but not as many are interested or knowledgeable (enough) to install Linux on their system, here is a safe way to try out Linux on your existing (Windows) system. The idea is that you insta…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now