[vox-tech] var is full - missing disk space?

[Peter Jay Salzman]

On Sun 30 Jul 06,  3:47 PM, Ken Bloom <kbloom at gmail.com> said:
> On Sunday 30 July 2006 15:00, Peter Jay Salzman wrote:
> > I thought half a GB was enough for /var, but yet it's full:
> >
> >    /dev/hdb2             581M  540M   11M  99% /var
> >
> > At the top level:
> >
> >    19K     backups
> >    43M     cache
> >    3.0K    games
> >    207M    lib
> >    1.0K    local
> >    2.0K    lock
> >    12M     log       <-- deleted old logs.  12MB is reasonable
> > anyhow. 12K     lost+found
> >    4.4M    mail
> >    1.0K    opt
> >    66K     run
> >    12M     spool
> >    2.0K    state
> >    1.6M    tmp
> >    156K    www
> >
> > But this doesn't appear to add up.  Ignoring the "K" directories:
> >
> > 43 + 207 + 12 + 4.4 + 12 + 1.6 = 280MB
> >
> > There appears to be around 262MB of free space missing, which can't
> > be accounted for by adding in the "K" directories.
> 
> You deleted old logs. Is the size of the directory before or after you 
> deleted the logs? How much did you delete? Is there currently a 
> discrepency between df and du? Did any of the files you deleted happen 
> to be in use? (If those files are still in use, then their space hasn't 
> been freed yet -- they're simply no longer linked into their directory. 
> usually SIGHUPping daemons makes them close and reopen all of their 
> file descriptors which will cause you to recover your space)
> 
> --Ken
 
The log file sizes were pretty much inconsequential.

But the problem had something to do with file handles not being released.  I
was going to fsck var.  Wanted to remount /var as ro, so used fuser to kill
all processes that had file handles open on /var.

After that, /var's free space became what it should've been.

So something wasn't releasing a filehandle.  Dunno what it was.  Weird!

Pete