I got two partitions, one for /var/log and another for /var/log/audit
But first one is showing full (and raising all the alrms) because of the second one, as it is inside. /var/log/audit account for disk space of /var/log even if they are separated partitions. here is the output for df -h
/dev/mapper/vg_system-lv_varlog 9.8G 9.7G 0 100% /var/log /dev/mapper/vg_system-lv_audit 26G 7.1G 18G 30% /var/log/audit
I did check and yes, /var/log used space without /var/log/audit makes only 985M
[root@server log]# du -sh --exclude=audit 985M .
And there is no hidden / deleted file (I checked with lsof)
so I got one partition with only 1Gb used but showing as full because of another partition inside it. should they not be independant for df and disk space? Am I missing something?