Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently the /var and /home folders have been clogging up on my server and I received a 'critical error' email saying that the /home folder was 100% full. I managed to fix it using the LVExtend command but I was just wondering how I can find out what was clogging the directories up? Are there logs of some sort?

I have a dedicated server w/ root access so I have full control. What can I do to prevent this from happening again as it's already happened twice?

Thanks,

James

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

Disks get full because files get written to them. To find what's using the space in a partition, du (for "Disk Usage") is the tool. I like to use:

du -hx --max-depth=1 /home

Because it limits itself to the partition of interest (-x) and doesn't give you excessive verbosity. If you just want a sorted list of space hogs, you can add |sort -h to the end of that command.

Once you've got that info, you can drill down into excessively-large looking directories to see where the usage is happening (/home/foo, /home/foo/suspicious, etc etc). What counts as "excessively-large looking" is a judgement you, as the admin, need to make based on the expected usage of your server.

Finding who/what is responsible for creating the files you consider to be excessive can be a little tricky. Using ls -l will show the ownership of the file(s), which is the first piece of info. If it's a regular user, then the problem could be cron jobs, a webapp the user is running, or a manually-invoked local command. That's something you'll have to discover for yourself, as it's your box. If the files are owned by root or another system user, then it's a system process and you get to hunt the culprit down (you should know what's running on your system and what it does, so it should be fairly easy).

As far as preventing it from happening again, if it's a user causing the problems, your options are:

  • Per-user quotas;
  • Penalising users for excess usage;
  • Proper capacity planning.

If it's a system process:

  • Managing disk usage of system process properly;
  • Proper capacity planning.

Based on your comment on Hawk's answer, the problem may be a capacity planning issue. If you're giving users enough space that they're storing 110GB of data and only using 4% of their quota, you need bigger disks (much, much bigger disks). If you're relying on overcommit to make money, sooner or later you're going to get bitten in the arse.

share|improve this answer
    
Hello, thanks for your very informative answer! Why would I need to get bigger disks if he's only used 4% of his 110GB allowance? :-) –  James Anderson Jul 13 '11 at 18:23
    
Because if you're running out space when the user's only used 4% of their 110GB allowance (or 4.4GB, by my calcuation), then you're going to have a real hard time if the user actually decides to use the other 105.6GB you've given them. Multiply this by the (presumable) rest of your customer base, and you're in a bit of a pickle. –  womble Jul 13 '11 at 23:07
add comment

/home is usually user files. /var has mysql, mail, log files etc

Do you have space limits for accounts in cpanel?

Ran these commands to see what is using the most space:

du -h -s /home/*

du -h -s /var/*

share|improve this answer
    
Hi Hawk, thanks for that. We limit account space on the server and the account which caused the issue only used about 4% of its allocated space. He has 110GB of disk space. He has lots of cron jobs, which may have caused the issue. The home folder was 100% full and /var was 97% full. –  James Anderson Jul 3 '11 at 17:31
    
Here's the /var command output; 44M /var/cache 429M /var/cpanel 0 /var/cvs 0 /var/db 0 /var/empty 0 /var/games 26G /var/lib 0 /var/local 4.0K /var/lock 886M /var/log 0 /var/mail 240K /var/named 0 /var/nis 0 /var/opt 0 /var/preserve 64K /var/profiles 300K /var/run 1006M /var/softaculous 4.3G /var/spool 676K /var/tmp 32K /var/www 0 /var/yp –  James Anderson Jul 3 '11 at 17:40
add comment

There are no logs tracking creation / changes to every file on the system.

du (and sort?) will give you stats on the size of files, but it'll be a huge list - have a look at 'find' to locate files which have been changed recently.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.