root filesystem getting filled
Root file system is getting filled frequently. Cant see any high size files inside / . But still / file system continuously getting filled.
Is there any bug in RHEL6.5 ?
Responses
Do you got /var under root then, check out for any bigger log files? if there are some log files which are bigger in size, you would need to delete it and then restart syslog service to get the space recovered which might was locked up. Also, check out for inode usage of root file system.. also, check if you've got vmcore to be configured under default /var/crash folder, if so then there might be some bigger files there which you might need to move out or delete .
Check for non-mounted partitions (examine your /etc/fstab) under "/"
ls / | egrep -v 'proc|sys|lost' | perl -ne 'chomp;system("mountpoint $_")' | egrep -v 'is a mountpoint' | awk '{print $1}' | perl -ne 'chomp;system("du -sk $_")'
That script above will show you the non-mounted heavy-hitter items that are filling up the "/" partition. There are probably more elegant ways of doing this...
There are of course other factors. In sort, someone may have written to a partition that was not mounted at the time, and after it being mounted, the files consuming your "/" partition are being obfuscated by the mounted mountpoint. Let's say you had a mountpoint named "/app" for a database, for instance, maybe even oracle. If for some reason "/app" was not mounted and someone installed oracle to the "/app" directory, it would attempt to install and may even fill the "/" partition because "/app" was not mounted. In this example, I cited a case I've seen in my environment. We had to unmount "/app" and clean it out, then remount "/app" and then the oracle folks had to reinstall oracle under "/app". While your situation may not be an exact fit for this, in PRINCIPLE, this is a potential factor where some partition that SHOULD have been mounted might not have been mounted, and stuff got written to the directory while unmounted, and if the partition was later mounted, it will not be seen as described earlier. THIS MAY NOT be your case, but it is one factor of many when diagnosing full "/" filesystems.
good luck
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
