I have Debian Jessie, /var/log on root partition of type ext3 (rw,relatime,data=ordered). Four days ago logrotate dumped tens of thousands files, this was fixed and files deleted. After this:
# du -hc /var/log/ 511M total
Files and subdirectories are only 255M:
#du -hc --exclude=.. --exclude=. /var/log/* /var/log/.* 255M total
The rest is directory itself:
# ls -ldh /var/log drwxr-xr-x 15 root root 257M Feb 18 06:55 /var/log # stat /var/log File: ‘/var/log’ Size: 268496896 Blocks: 524936 IO Block: 4096 directory
Some operations (look random for me) on /var/log take very long time (up to 5 minutes). I can neigher umount nor remount it readonly right now for non-technical reasons.
Why such large directory may arise and why it causes huge lags? How can i "deflate" it without unmounting? What may be caveats of stopping rsyslog, creating a new directory, moving /var/log content to it and renaming to /var/log, similar to suggested in https://serverfault.com/a/487245 ?