Phantom space usage in /

Hi everyone,

Got an interesting one (well, interesting to me)

I have a box with a 5Gb / mount point. Checking for large files I found nothing and in fact when I did a full du I found that there was only 1.6Gb in use! And yet 100% used in /

So there's an unaccounted 3.4Gb somewhere!

The box isn't running oracle but I thought I'd check lsof |grep deleted anyway and found nothing in that mount point.

Did an inode check and only 14% of inodes are in use.

Any idea what i can do to track down phantom files or do you think I might just have to bounce the box and see if something has held some disk space open for some reason? I'd rather not bounce it as it's running a live service.

Thanks

This has been covered many times before.

Basically, what you are describing is what happens when someone removes a file that a process still has open. At some time in the past did you look for and remove a few large files? If so, did you kill off the processes that were reading from or writing to those files before you removed them?

Thanks Don, unfortunately I had already tried searching using lsof for anything like that.

In this case it was a mount point that had got itself in a weird state. It was still mounted according to df but wasn't actually mounted so the app was spamming the log in that folder which was now part of /

Got it sorted in the end Weird that it was showing as mounted when it wasn't though.

I'm glad to hear that you found the problem.

Thank you for letting us know what you found.