Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I ran this command:

root@aa:/# du -h --max-depth=1 /
du: cannot access `/proc/4002/task/4002/fd/4': No such file or directory
du: cannot access `/proc/4002/task/4002/fdinfo/4': No such file or directory
du: cannot access `/proc/4002/fd/4': No such file or directory
du: cannot access `/proc/4002/fdinfo/4': No such file or directory
0       /proc
44G     /home
4.9M    /bin
4.0K    /selinux
85M     /lib
4.0K    /srv
496G    /var
4.0K    /mnt
0       /sys
12K     /tmp
4.0K    /media
3.0M    /etc
5.0M    /sbin
448M    /usr
4.0K    /boot
4.0K    /opt
348K    /dev
36K     /root
540G    /

What is taking up 540Gigs of space? I don't even see it on the list. I'm using ubuntu, latest version.

Edit: It seems that /var/log is taking up 450Gigs of space.

This is ls -l in var/log:

drwxr-xr-x 2 root   root 4.0K Dec  4 19:27 apt
-rw-r--r-- 1 root   root  10K Dec 14 22:16 aptitude
-rw-r--r-- 1 root   root  610 Dec  4 01:46 aptitude.1.gz
-rw-r--r-- 1 root   root  914 Aug 24 06:17 aptitude.2.gz
-rw-r--r-- 1 root   root  439 Aug 14 18:43 aptitude.3.gz
-rw-r----- 1 syslog adm  142K Dec 16 20:58 auth.log
-rw-r----- 1 syslog adm  1.2M Dec 15 19:25 auth.log.0
-rw-r----- 1 syslog adm   88K Dec 13 19:25 auth.log.1.gz
-rw-r----- 1 syslog adm   18K Dec  6 19:28 auth.log.2.gz
-rw-r----- 1 syslog adm   86K Dec  4 19:25 auth.log.3.gz
-rw-r----- 1 syslog adm   91K Dec  3 19:40 auth.log.4.gz
-rw-r----- 1 syslog adm  163K Nov 29 19:28 auth.log.5.gz
-rw-r----- 1 syslog adm   91K Nov 25 19:30 auth.log.6.gz
-rw-r----- 1 root   adm    31 Apr 23  2009 boot
-rw-rw---- 1 root   utmp    0 Dec  1 19:34 btmp
-rw-rw---- 1 root   utmp   20 Nov  1 19:25 btmp.1.gz
-rw-r----- 1 syslog adm  794K Dec 16 20:56 daemon.log
-rw-r----- 1 syslog adm  903K Dec 13 19:24 daemon.log.0
-rw-r----- 1 syslog adm   85K Dec 10 19:39 daemon.log.1.gz
-rw-r----- 1 syslog adm   19K Dec  6 19:24 daemon.log.2.gz
-rw-r----- 1 syslog adm  674K Dec  5 19:24 daemon.log.3.gz
-rw-r----- 1 syslog adm   57K Nov 29 19:24 daemon.log.4.gz
-rw-r----- 1 syslog adm   57K Nov 22 19:24 daemon.log.5.gz
-rw-r----- 1 syslog adm   76K Nov 19 19:29 daemon.log.6.gz
-rw-r----- 1 syslog adm   11K Dec 16 20:51 debug
-rw-r----- 1 syslog adm  1.7K Dec 10 23:05 debug.0
-rw-r----- 1 syslog adm   128 Oct  8 09:13 debug.1.gz
-rw-r----- 1 syslog adm   75K Sep 18 07:57 debug.2.gz
-rw-r----- 1 syslog adm   15K Sep 13 19:25 debug.3.gz
-rw-r----- 1 syslog adm  103K Aug 29 19:30 debug.4.gz
-rw-r----- 1 syslog adm  108K Aug 20 19:48 debug.5.gz
-rw-r----- 1 root   adm   10K Dec 16 20:51 dmesg
-rw-r----- 1 root   adm   10K Dec 16 20:42 dmesg.0
-rw-r----- 1 root   adm  3.8K Dec 16 20:27 dmesg.1.gz
-rw-r----- 1 root   adm  3.6K Dec 14 22:24 dmesg.2.gz
-rw-r----- 1 root   adm  3.9K Sep  5 20:41 dmesg.3.gz
-rw-r----- 1 root   adm  3.7K Sep  5 09:47 dmesg.4.gz
-rw-r----- 1 root   adm   18K Dec 14 22:17 dpkg.log
-rw-r----- 1 root   adm   714 Dec  4 01:46 dpkg.log.1
-rw-r----- 1 root   adm  2.1K Aug 24 06:17 dpkg.log.2.gz
-rw-r--r-- 1 root   root 1.3K Aug 14 18:44 dpkg.log.3.gz
-rw-r--r-- 1 root   root  32K Aug 24 06:17 faillog
drwxr-xr-x 2 root   root 4.0K Apr 23  2009 fsck
-rw-r----- 1 syslog adm   47K Dec 16 20:51 kern.log
-rw-r----- 1 syslog adm   113 Oct  8 09:13 kern.log.0
-rw-r----- 1 syslog adm   75K Sep 18 07:57 kern.log.1.gz
-rw-r----- 1 syslog adm   15K Sep 13 19:25 kern.log.2.gz
-rw-r----- 1 syslog adm  105K Sep 12 19:22 kern.log.3.gz
-rw-r----- 1 syslog adm  103K Aug 29 19:30 kern.log.4.gz
-rw-r----- 1 syslog adm  108K Aug 20 19:48 kern.log.5.gz
-rw-rw-r-- 1 root   utmp 286K Dec 16 20:51 lastlog
-rw-r----- 1 syslog adm     0 Apr 23  2009 lpr.log
-rw-r----- 1 syslog adm     0 Apr 23  2009 mail.err
-rw-r----- 1 syslog adm     0 Apr 23  2009 mail.info
-rw-r----- 1 syslog adm     0 Apr 23  2009 mail.log
-rw-r----- 1 syslog adm     0 Apr 23  2009 mail.warn
-rw-r----- 1 syslog adm   44K Dec 16 20:51 messages
-rw-r----- 1 syslog adm   16K Dec 13 19:26 messages.0
-rw-r----- 1 syslog adm  1.3K Dec  6 19:26 messages.1.gz
-rw-r----- 1 syslog adm  1.3K Nov 29 19:09 messages.2.gz
-rw-r----- 1 syslog adm  1.3K Nov 22 19:08 messages.3.gz
drwxr-s--- 2 mysql  adm   20K Dec 16 20:51 mysql
-rw-r----- 1 mysql  adm     0 Dec  9 00:07 mysql.err
-rw-r----- 1 mysql  adm     0 Dec 16 19:37 mysql.log
-rw-r----- 1 mysql  adm     0 Dec 15 19:25 mysql.log.1
-rw-r----- 1 mysql  adm    20 Dec 14 19:25 mysql.log.2.gz
-rw-r----- 1 mysql  adm    20 Dec 13 19:26 mysql.log.3.gz
-rw-r----- 1 mysql  adm    20 Dec 12 19:33 mysql.log.4.gz
-rw-r----- 1 mysql  adm    20 Dec 11 19:48 mysql.log.5.gz
-rw-r----- 1 mysql  adm    20 Dec 10 19:43 mysql.log.6.gz
-rw-r----- 1 mysql  adm    20 Dec  9 19:43 mysql.log.7.gz
-rw-r----- 1 mysql  adm    20 Dec  9 00:07 mysql.log.8.gz
drwxr-sr-x 2 news   news 4.0K Apr 23  2009 news
-rw-r--r-- 1 root   root    0 Aug 17 20:40 pycentral.log
-rw-r----- 1 syslog adm  261K Dec 16 20:58 syslog
-rw-r----- 1 syslog adm  318K Dec 15 19:25 syslog.0
-rw-r----- 1 syslog adm   22K Dec 14 19:25 syslog.1.gz
-rw-r----- 1 syslog adm   22K Dec 13 19:25 syslog.2.gz
-rw-r----- 1 syslog adm   21K Dec 12 19:30 syslog.3.gz
-rw-r----- 1 syslog adm   23K Dec 11 19:44 syslog.4.gz
-rw-r----- 1 syslog adm   27K Dec 10 19:40 syslog.5.gz
-rw-r----- 1 syslog adm   25K Dec  9 19:40 syslog.6.gz
-rw-r--r-- 1 root   root 258K Dec 16 20:49 udev
-rw-r----- 1 syslog adm     0 Apr 23  2009 user.log
-rw-rw-r-- 1 root   utmp  42K Dec 16 20:51 wtmp
-rw-rw-r-- 1 root   utmp  478 Nov 25 02:21 wtmp.1.gz
share|improve this question

5 Answers 5

up vote 1 down vote accepted

your /var is taking that space - almost 500GB. investigate it more in details.

can it be unrotated /var/log with logs ?

or maybe it's /var/spool with some garbage mails ?

or maybe /var/www ?

run

du -h /var > /some/file.txt

upload file somewhere and post here. or just run

du -h /var/|less

and figure out by yourself.

share|improve this answer
1  
Kind of the danger with using -h, easy to miss something... big numbers don't jump out at you. –  Kyle Brandt Dec 16 '09 at 20:58
    
Thanks. It is true that /var/log is taking up much space. I did "ls -l" in var-log. How do I know what is taking up the 450G? –  Alex Dec 16 '09 at 21:00
    
Ok, it seems like ./mysql has a lot of files in it (mysql-bin.005511) files like that. Those are like a gig each! –  Alex Dec 16 '09 at 21:01

It's entirely possible that it's a spurious listing from du. /var/log/lastlogis generally a sparse file which appears much larger it they is from some utilities, with ls -l displaying the proper size. Try a du -ak | sort -n in /var/log and see if that's the case here.

share|improve this answer

two things,
1.) run something like this to see where within /var specifically

[root@log ~]# find /var -type d -exec du -s {} \; | sort -nr | head
1161916 /var
1046368 /var/log
98196   /var/cache
97796   /var/cache/yum
31468   /var/cache/yum/core-0
29204   /var/cache/yum/epel
28760   /var/cache/yum/base
16948   /var/lib
16012   /var/lib/rpm
5864    /var/cache/yum/updates

2.) check to see that you don't have a lot of large deleted files that still have an open file handle to them from something. this is frequently the cause of discrepancies between du and df.

[root@log ~]# lsof | grep deleted
syslogd    2728      root    7w      REG              253,0 811129687     688393 /var/log/rsyncd.log.1 (deleted)
tail      30912      root    0u      CHR              136,1                    3 /dev/pts/1 (deleted)
tail      30912      root    1u      CHR              136,1                    3 /dev/pts/1 (deleted)
tail      30912      root    2u      CHR              136,1                    3 /dev/pts/1 (deleted)
tail      30912      root    3r      REG              253,0   1233377     688370 /var/log/messages.5 (deleted)
share|improve this answer

mysql-bin.ddddd files are MySQL binary log files. They can grow very large. If you don't need replication or advanced data recovery you can disable them. Edit my.cnf file and comment out the lines containing log-bin, expire_log_days and max_binlog_size.

#log-bin
...
#expire_logs_days = 10
...
#max_binlog_size = 100M

then restart MySQL and delete all mysql-bin files.

share|improve this answer

Have you compared with the output of df -h /var ?

Sometimes, if a file is deleted while it is being written, it can mess up the meta data of the file, so the declared size of the file keeps growing while it's actually not taking any space. In that case, du might show you a huge space while there's actually not much used.

Also try to see if there's deleted files used by running programs with lsof | grep -i deleted. Killing such programs could fix your issue.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.