root filesystem getting filled

Latest response

Root file system is getting filled frequently. Cant see any high size files inside / . But still / file system continuously getting filled.

Is there any bug in RHEL6.5 ?

Responses

Do you got /var under root then, check out for any bigger log files? if there are some log files which are bigger in size, you would need to delete it and then restart syslog service to get the space recovered which might was locked up. Also, check out for inode usage of root file system.. also, check if you've got vmcore to be configured under default /var/crash folder, if so then there might be some bigger files there which you might need to move out or delete .

to add on to that good tip, if you find that /var/ or /var/log is not it's own separate file system, you may find log files filling up the "/" filesystem. Basically, consider the system's role and what directories would fill up and make appropriate partitions to protect "/" from filling up.

Check for non-mounted partitions (examine your /etc/fstab) under "/"

ls / | egrep -v 'proc|sys|lost' | perl -ne 'chomp;system("mountpoint $_")' | egrep -v 'is a mountpoint' | awk '{print $1}' | perl -ne 'chomp;system("du -sk $_")'

That script above will show you the non-mounted heavy-hitter items that are filling up the "/" partition. There are probably more elegant ways of doing this...

There are of course other factors. In sort, someone may have written to a partition that was not mounted at the time, and after it being mounted, the files consuming your "/" partition are being obfuscated by the mounted mountpoint. Let's say you had a mountpoint named "/app" for a database, for instance, maybe even oracle. If for some reason "/app" was not mounted and someone installed oracle to the "/app" directory, it would attempt to install and may even fill the "/" partition because "/app" was not mounted. In this example, I cited a case I've seen in my environment. We had to unmount "/app" and clean it out, then remount "/app" and then the oracle folks had to reinstall oracle under "/app". While your situation may not be an exact fit for this, in PRINCIPLE, this is a potential factor where some partition that SHOULD have been mounted might not have been mounted, and stuff got written to the directory while unmounted, and if the partition was later mounted, it will not be seen as described earlier. THIS MAY NOT be your case, but it is one factor of many when diagnosing full "/" filesystems.

good luck

Ranjith Rajendran

Did you get this resolved?

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.