/root direcotory is full

HI today i realized my produciton server's root direcotry is full

but if i  do du-sh it only show 67M, but from df -h you an see it takes 1012 M!! what makes my /root full ??

[root@xxx~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/cciss/c0d0p9    1012M 1012M     0 100% /
/dev/cciss/c0d0p1     122M   39M   77M  34% /boot

then cd /root
[root@xxx~]# du -sh

then :

[root@xxx~]# du -h /root
132K    /root/.nautilus/metafiles
140K    /root/.nautilus
30M     /root/.Trash
4.0K    /root/.kde/share/services
4.0K    /root/.kde/share/mimelnk
4.0K    /root/.kde/share/apps/kmail/search
4.0K    /root/.kde/share/apps/kmail/imap
4.0K    /root/.kde/share/apps/kmail/dimap
20K     /root/.kde/share/apps/kmail
4.0K    /root/.kde/share/apps/kcookiejar
32K     /root/.kde/share/apps/kconf_update
16K     /root/.kde/share/apps/konqueror
4.0K    /root/.kde/share/apps/kfm/bookmarks
8.0K    /root/.kde/share/apps/kfm
4.0K    /root/.kde/share/apps/khtml
88K     /root/.kde/share/apps
4.0K    /root/.kde/share/servicetypes
4.0K    /root/.kde/share/config/session
252K    /root/.kde/share/config
4.0K    /root/.kde/share/applnk
4.0K    /root/.kde/share/locale
364K    /root/.kde/share
368K    /root/.kde
592K    /root/.mcop/trader-cache
600K    /root/.mcop
316K    /root/.metacity/sessions
324K    /root/.metacity
16K     /root/.elinks
36K     /root/bin
8.0K    /root/.gconf/apps/procman/proctree
8.0K    /root/.gconf/apps/procman/disktreenew
24K     /root/.gconf/apps/procman
8.0K    /root/.gconf/apps/file-roller/dialogs/extract
12K     /root/.gconf/apps/file-roller/dialogs
8.0K    /root/.gconf/apps/file-roller/general
8.0K    /root/.gconf/apps/file-roller/listing
32K     /root/.gconf/apps/file-roller
12K     /root/.gconf/apps/nautilus
8.0K    /root/.gconf/apps/ggv/layout
12K     /root/.gconf/apps/ggv
8.0K    /root/.gconf/apps/gedit-2/preferences/ui/open_save
12K     /root/.gconf/apps/gedit-2/preferences/ui
16K     /root/.gconf/apps/gedit-2/preferences
20K     /root/.gconf/apps/gedit-2
16K     /root/.gconf/apps/panel/objects/wordprocessor_launcher
16K     /root/.gconf/apps/panel/objects/presentation_launcher
16K     /root/.gconf/apps/panel/objects/spreadsheet_launcher
16K     /root/.gconf/apps/panel/objects/email_launcher
16K     /root/.gconf/apps/panel/objects/web_launcher
92K     /root/.gconf/apps/panel/objects
12K     /root/.gconf/apps/panel/toplevels/bottom_panel
24K     /root/.gconf/apps/panel/toplevels
16K     /root/.gconf/apps/panel/general
12K     /root/.gconf/apps/panel/applets/clock/prefs
24K     /root/.gconf/apps/panel/applets/clock
12K     /root/.gconf/apps/panel/applets/window_list/prefs
24K     /root/.gconf/apps/panel/applets/window_list
12K     /root/.gconf/apps/panel/applets/mixer/prefs
24K     /root/.gconf/apps/panel/applets/mixer
12K     /root/.gconf/apps/panel/applets/workspace_switcher/prefs
24K     /root/.gconf/apps/panel/applets/workspace_switcher
108K    /root/.gconf/apps/panel/applets
252K    /root/.gconf/apps/panel
8.0K    /root/.gconf/apps/gnome-settings/gedit
16K     /root/.gconf/apps/gnome-settings/gnome-nettool
12K     /root/.gconf/apps/gnome-settings/gnome-search-tool
48K     /root/.gconf/apps/gnome-settings
12K     /root/.gconf/apps/gnome-search-tool/select
24K     /root/.gconf/apps/gnome-search-tool
436K    /root/.gconf/apps
12K     /root/.gconf/desktop/gnome/applications/window_manager
24K     /root/.gconf/desktop/gnome/applications
16K     /root/.gconf/desktop/gnome/file_views
8.0K    /root/.gconf/desktop/gnome/accessibility/keyboard
12K     /root/.gconf/desktop/gnome/accessibility
16K     /root/.gconf/desktop/gnome/background
12K     /root/.gconf/desktop/gnome/peripherals/keyboard/xkb.sysbackup
16K     /root/.gconf/desktop/gnome/peripherals/keyboard/xkb
40K     /root/.gconf/desktop/gnome/peripherals/keyboard
52K     /root/.gconf/desktop/gnome/peripherals
132K    /root/.gconf/desktop/gnome
144K    /root/.gconf/desktop
588K    /root/.gconf
8.0K    /root/Desktop
8.0K    /root/.xcdroast
4.0K    /root/.qt
4.0K    /root/.rhopenoffice1.1/user/template
20K     /root/.rhopenoffice1.1/user/gallery
16K     /root/.rhopenoffice1.1/user/basic/Standard
28K     /root/.rhopenoffice1.1/user/basic
8.0K    /root/.rhopenoffice1.1/user/autotext
4.0K    /root/.rhopenoffice1.1/user/store
4.0K    /root/.rhopenoffice1.1/user/wordbook
4.0K    /root/.rhopenoffice1.1/user/temp
492K    /root/.rhopenoffice1.1/user/registry/cache
24K     /root/.rhopenoffice1.1/user/registry/data/org/openoffice/Office
36K     /root/.rhopenoffice1.1/user/registry/data/org/openoffice
40K     /root/.rhopenoffice1.1/user/registry/data/org
44K     /root/.rhopenoffice1.1/user/registry/data
540K    /root/.rhopenoffice1.1/user/registry
4.0K    /root/.rhopenoffice1.1/user/psprint/driver
4.0K    /root/.rhopenoffice1.1/user/psprint/fontmetric
40K     /root/.rhopenoffice1.1/user/psprint
4.0K    /root/.rhopenoffice1.1/user/plugin
596K    /root/.rhopenoffice1.1/user/config
4.0K    /root/.rhopenoffice1.1/user/uno_packages
4.0K    /root/.rhopenoffice1.1/user/backup
4.0K    /root/.rhopenoffice1.1/user/autocorr
68K     /root/.rhopenoffice1.1/user/database/biblio
72K     /root/.rhopenoffice1.1/user/database
1.4M    /root/.rhopenoffice1.1/user
4.0K    /root/.rhopenoffice1.1/share/dict/ooo
8.0K    /root/.rhopenoffice1.1/share/dict
4.0K    /root/.rhopenoffice1.1/share/uno_packages
4.0K    /root/.rhopenoffice1.1/share/autocorr
4.0K    /root/.rhopenoffice1.1/share/samples/english
8.0K    /root/.rhopenoffice1.1/share/samples
28K     /root/.rhopenoffice1.1/share
4.0K    /root/.rhopenoffice1.1/program/addin
8.0K    /root/.rhopenoffice1.1/program
2.1M    /root/.rhopenoffice1.1
8.0K    /root/.gnome2_private
12K     /root/.gstreamer-0.8
24K     /root/.mozilla/firefox/gx23i8pm.default/chrome
4.0K    /root/.mozilla/firefox/gx23i8pm.default/Cache.Trash
24K     /root/.mozilla/firefox/gx23i8pm.default/extensions
16K     /root/.mozilla/firefox/gx23i8pm.default/US
8.0K    /root/.mozilla/firefox/gx23i8pm.default/bookmarkbackups
29M     /root/.mozilla/firefox/gx23i8pm.default/Cache
30M     /root/.mozilla/firefox/gx23i8pm.default
31M     /root/.mozilla/firefox
31M     /root/.mozilla
48K     /root/.config/menus
56K     /root/.config
12K     /root/.vmware
8.0K    /root/.eggcups
20K     /root/.vnc
32K     /root/.ssh
4.0K    /root/vmware
4.0K    /root/Mail/inbox/cur
4.0K    /root/Mail/inbox/new
4.0K    /root/Mail/inbox/tmp
16K     /root/Mail/inbox
4.0K    /root/Mail/sent-mail/cur
4.0K    /root/Mail/sent-mail/new
4.0K    /root/Mail/sent-mail/tmp
16K     /root/Mail/sent-mail
4.0K    /root/Mail/outbox/cur
4.0K    /root/Mail/outbox/new
4.0K    /root/Mail/outbox/tmp
16K     /root/Mail/outbox
4.0K    /root/Mail/trash/cur
4.0K    /root/Mail/trash/new
4.0K    /root/Mail/trash/tmp
16K     /root/Mail/trash
4.0K    /root/Mail/drafts/cur
4.0K    /root/Mail/drafts/new
4.0K    /root/Mail/drafts/tmp
16K     /root/Mail/drafts
124K    /root/Mail
16K     /root/.gnome2/share/fonts
16K     /root/.gnome2/share/cursor-fonts
40K     /root/.gnome2/share
8.0K    /root/.gnome2/keyrings
4.0K    /root/.gnome2/file-roller
32K     /root/.gnome2/accels
8.0K    /root/.gnome2/nautilus-scripts
52K     /root/.gnome2/panel2.d/default/launchers
60K     /root/.gnome2/panel2.d/default
68K     /root/.gnome2/panel2.d
208K    /root/.gnome2
8.0K    /root/.gconfd
1.3M    /root/.thumbnails/fail/gnome-thumbnail-factory
1.3M    /root/.thumbnails/fail
176K    /root/.thumbnails/normal
1.5M    /root/.thumbnails
8.0K    /root/tmp
16K     /root/.borland
8.0K    /root/.gnome/mime-info
4.0K    /root/.gnome/application-info
16K     /root/.gnome/gnome-vfs
36K     /root/.gnome
67M     /root
[root@beaver ~]# du -sh *
36K     bin
0       date_marker
4.0K    dead.letter
8.0K    Desktop
124K    Mail
4.0K    mbox
8.0K    openvpn-status.log
8.0K    tmp
4.0K    vmware

Extra note : if root gets to many emails will it fill /root partition ??

please help me to solve this problem
LVL 29
Who is Participating?
http:// thevpn.guruCommented:
As said above start out with

du -sh /*

This should give you the directory using the space..should be var or usr from my expectations.
fusiul01, you are confusing the directory /root (the home directory for the root userid) and the real root directory "/".

What have you installed and are all your file systems mounted?

du -k / | sort -r

this will give you size in KB, sorted by size

Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

fosiul01Author Commented:
HI thank
no i didnot install nothing from last 1 year!!

[root@xx~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/cciss/c0d0p9    1012M 1012M     0 100% /
/dev/cciss/c0d0p1     122M   39M   77M  34% /boot
/dev/cciss/c0d0p2      73G  7.1G   62G  11% /bv8
none                 1014M     0 1014M   0% /dev/shm
/dev/cciss/c0d0p5     9.9G  667M  8.7G   7% /home
/dev/cciss/c0d0p8    1012M   34M  927M   4% /tmp
/dev/cciss/c0d0p6     9.9G  5.5G  3.9G  59% /usr
/dev/cciss/c0d0p3      35G   21G   13G  62% /var

du -k / | sort -nr
fosiul01Author Commented:
du -k / | sort -r , its giving me to many files such as form this direcotry as well /usr
is that right ??
Actually 67M out of 1012 is quite high...

Have you tried housekeeping your firefox settings.
> 29M     /root/.mozilla/firefox/gx23i8pm.default/Cache
> 30M     /root/.mozilla/firefox/gx23i8pm.default
fosiul01Author Commented:
here is du-sh /*

[root@beaver ~]# du -sh /*
0       /backuplog010908
0       /backuplog011008
8.5M    /backuplog020908
0       /backuplog021008
8.5M    /backuplog030908
0       /backuplog031008
8.5M    /backuplog040908
8.6M    /backuplog050908
8.4M    /backuplog060808
0       /backuplog061008
8.5M    /backuplog070808
8.5M    /backuplog080808
8.6M    /backuplog080908
8.6M    /backuplog090908
8.6M    /backuplog100908
8.5M    /backuplog110808
8.6M    /backuplog110908
8.5M    /backuplog120808
8.6M    /backuplog120908
8.5M    /backuplog130808
8.5M    /backuplog140808
8.5M    /backuplog150808
8.5M    /backuplog150908
8.5M    /backuplog160908
8.5M    /backuplog170908
8.5M    /backuplog180808
8.5M    /backuplog180908
8.5M    /backuplog190808
8.6M    /backuplog190908
8.5M    /backuplog200808
0       /backuplog210808
8.5M    /backuplog220808
8.6M    /backuplog220908
8.6M    /backuplog230908
4.4M    /backuplog240908
0       /backuplog250808
4.0K    /backuplog250908
8.5M    /backuplog260808
4.0K    /backuplog260908
8.5M    /backuplog270808
8.5M    /backuplog280808
8.5M    /backuplog290808
4.0K    /backuplog290908
0       /backuplog300908
6.4M    /bin
34M     /boot
I guess in this case your /root was filling up / (root)....
there must be a unix joke in there somewhere...
then again.....Just seen the last post....

Does anything strike you as being large there?
fosiul01Author Commented:
HOw come all the backup log

0       /backuplog010908
0       /backuplog011008
8.5M    /backuplog020908

is those in root directory ??

[root@beaver ~]# locate ackuplog020908
... sorry finger trouble...

What is creating the backuplog files/directories?
http:// thevpn.guruCommented:

rm -rf /backuplog*

then try df -h
fosiul01Author Commented:

rm -rf /backuplog*

now its like this :

[root@beaver ~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/cciss/c0d0p9    1012M  736M  225M  77% /
/dev/cciss/c0d0p1     122M   39M   77M  34% /boot
/dev/cciss/c0d0p2      73G  7.1G   62G  11% /bv8
none                 1014M     0 1014M   0% /dev/shm
/dev/cciss/c0d0p5     9.9G  667M  8.7G   7% /home
/dev/cciss/c0d0p8    1012M   34M  927M   4% /tmp
/dev/cciss/c0d0p6     9.9G  5.5G  3.9G  59% /usr
/dev/cciss/c0d0p3      35G   21G   13G  62% /var

http:// thevpn.guruCommented:
Great :) ...now we need to know what application is writting those logs there and have them written to /var/logs/ or you have to remove them daily :)
OK, but something must be creating the backup logs in the first place, you need to find out what it is or you will be doing the same in 736/8.5M days time!
oops, there is an echo, sorry.... I'll leave well alone :-)
fosiul01Author Commented:
yes, but how will i know ??

I didnot configure this server, its previous IT guy he did

look in crontab for scheduled jobs
http:// thevpn.guruCommented:
hmm....there are methods..you could use auditd...or simpler

lsof | grep backuplog

However the latter command only works while the backup is running...however since the backups are periodic..you might want to check the crontab first for backup jobs.
http:// thevpn.guruCommented:
Jools this time I was your echo :)
fosiul01Author Commented:
ok i will check those tomorrow, as far i know 2 backups run every night

which do full backup then write to a tap drive thats all

just tel me

0       /backuplog010908

if i want to see this backuplog010908 log , how will i see this ??
if i can check those then i would of know what creating those logs

cat /backuplog010908 ??
fosiul01Author Commented:
what is echo ?? didnot understand!!

   Dont worry about the `echo` it's just a bit of light banter.

You need to find the script that creates the backup logs. You can see what jobs are scheduled by using crontab -l OR you may need to look in the cron directories.

Below is a slightly edited list of cron files on my system,

# ls -al /etc/cron*
-rw-r--r-- 1 root root    0 Jun 16 21:52 /etc/cron.deny
-rw-r--r-- 1 root root  255 Jan  6  2007 /etc/crontab

-rw-r--r--   1 root root   139 Jan  9  2007 mrtg
-rw-------   1 root root   366 May 24 17:54 sa-update
-rw-r--r--   1 root root   188 May 24 16:47 sysstat

-rwxr-xr-x   1 root root   133 Jan  9  2007 00webalizer
-rwxr-xr-x   1 root root   379 Mar 28  2007 0anacron
lrwxrwxrwx   1 root root    39 Jul  7 22:35 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl
-rwxr-xr-x   1 root root  1042 May 24 18:30 certwatch
-rwxr-xr-x   1 root root   118 Jun 22 02:53 cups
-rwxr-xr-x   1 root root   180 Dec  2  2007 logrotate
-rwxr-xr-x   1 root root   418 Jan  6  2007 makewhatis.cron
-rwxr-xr-x   1 root root   137 Mar 14  2007 mlocate.cron
-rwxr-xr-x   1 root root  2181 Jun 21  2006 prelink
-rwxr-xr-x   1 root root   114 May 24 19:44 rpm
-rwxr-xr-x   1 root root   271 Nov 18  2007 squirrelmail.cron
-rwxr-xr-x   1 root root   290 Mar 15  2007 tmpwatch


-rwxr-xr-x   1 root root   381 Mar 28  2007 0anacron

-rwxr-xr-x   1 root root   380 Mar 28  2007 0anacron
-rwxr-xr-x   1 root root   414 Jan  6  2007 makewhatis.cron

cron is controlled by the crontab file

# more /etc/crontab

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

From the (run-parts) section above, the scripts in cron.hourly are run every minute past the hour, the scripts in cron.daily are run a 04:02am every day etc etc.

You may have a job scheduled in the crontab file directly or possibly in one of the cron.* directories. This will be the name of the script that runs your backup. You *may* also have to look at the backup script and modify it to change the location of the backup log.

Hint: scripting a backup job to chuck the backup log in the root directory is not the best idea.

If you go with the shakoush2001's suggestion above for putting it in /var/log (as good a place as any!!) then you will need to check the logs and do your own housekeeping or configuring logrotate to do it for you.

.. yes... cat will display the backup log on screen...

toodle pip!

fosiul01Author Commented:
HI jools thanks

i just want one more clarification then i will close this questioin

you said in your first comments : fusiul01, you are confusing the directory /root (the home directory for the root userid) and the real root directory "/".

i received 2 email every day from server subject is from Logwatch

in one email it say : Disk space
  /dev/sda8          35G   6.6G  27G  20%    /

and anohtr one  

Disk Space

Filesystem            Size  Used Avail Use% Mounted on
/dev/cciss/c0d0p9    1012M  736M  225M  77% /

both both is comming from Same Server!!!

then why this difference ??
They are not both from the same server, one is 35G on sda8, the other is 1G on c0d0p9.

Check the headers of the email, post back here
fosiul01Author Commented:
hahaha so sorry!! its another server.

i didnot think, i am receiving email from another server

this server actually places in DMZ , i didnothink , previous IT guy will configure this server to sendmail via logwatch

just explain me this one :

you said in your first comments : fusiul01, you are confusing the directory /root (the home directory for the root userid) and the real root directory "/".

/dev/cciss/c0d0p9    1012M  736M  225M  77% /  : is this home for root user or its root directory ??
/ is the real root directory. Under this there is a "root" directory (/root) which is the home directory for the root user.

You said that /root was saying 67M used but when you did the df is said 1012MB. The difference being that df reported the file system size for the real root directory (/) and du reported the size of the root users home directory.

Later in the thread, omar and shakoush suggested doing the du on / which showed up the size of the backup log files in root (yes, the real root). Now I may add to the confusion here if I say that /root is under / (df -k /; df -k /root).

Now, hopefully, you have found the script that creates the backup log files and either changed it to log somewhere else or have a procedure in place to check the logs and do manual housekeeping.

Not a bad team effort really :-)
fosiul01Author Commented:
thats why i like this EE , good team work always.

i will ask few more question on this issue on new one, its not fair to ask all the question in one.

Thanks for the help
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.