|
SysAdmin Topics
|
How to Check for Deleted Files Held Open in UFS File Systemsby Ross Moffatt, July 2008 This tech tip provides a procedure for determining whether deleted files are being held open in UFS file systems and are using up file system space. If this situation occurs, then the process that has the files open needs to be restarted, or the host needs to be rebooted. Note: This procedure works on Solaris versions up to and including Solaris 9. It should work on systems that run the Solaris 10 OS, but that was not tested. Example of Checking for Deleted Files That Are Held OpenHere I compare the output of the df command, which reports file system space usage, and the du command, which reports actual file usage. 1. Determine the physical file systems by running vfstab:
more /etc/vfstab
fli-usm1:/ # more /etc/vfstab
#device device mount FS fsck mount mount
#to mount to fsck point type pass at boot options
#
fd - /dev/fd fd - no -
/proc - /proc proc - no -
/dev/md/dsk/d1 - - swap - no -
/dev/md/dsk/d0 /dev/md/rdsk/d0 / ufs 1 no -
/dev/md/dsk/d3 /dev/md/rdsk/d3 /usr ufs 1 no -
/dev/md/dsk/d4 /dev/md/rdsk/d4 /var ufs 1 no -
/dev/md/dsk/d6 /dev/md/rdsk/d6 /opt ufs 2 yes -
swap - /tmp tmpfs - yes -
In this example, the system is using Solstice DiskSuite to mirror drives, and the physical drives are the ones with /dev/md/dsk type device files, that is swap, /, /usr, /var, and /opt. 2. Run the df command, which gives us the file system usage in kilobytes: # df -k Filesystem kbytes used avail capacity Mounted on /dev/md/dsk/d0 2082495 77929 1942092 4% / /dev/md/dsk/d3 2082495 120161 1899860 6% /usr /proc 0 0 0 0% /proc mnttab 0 0 0 0% /etc/mnttab fd 0 0 0 0% /dev/fd /dev/md/dsk/d4 20931816 198299 20524199 1% /var swap 1821488 16 1821472 1% /var/run swap 1821488 16 1821472 1% /tmp /dev/md/dsk/d6 6705683 53820 6584807 1% /opt 3. For each mounted file system, run the du command to compare usage in kilobytes. Don't worry about "virtual" file systems, such as /proc, /etc/mnttab, /dev/fd, and /var/run. Also, don't worry about swap. There will be some difference between these figures. This is an issue only if there is a large difference between the values, for example, if df says the file system is full and du says it is empty. # du -skd / 74749 The df command reported 77929. # du -skd /usr 105545 /usr The df command reported 120161. # du -sd /usr 211090 /usr The df command reported nothing. # du -skd /var 177553 /var The df command reported 198299. # du -skd /opt 47156 /opt The df command reported 53820. ConclusionIn the previous example, the root file system, /, is using 74749 Kbytes according to the du command. The reported file usage from df is 77929 Kbytes. The other file systems are shown in similar fashion, so you can compare the output between df and du. The reported differences are due to df reporting on space taken up by files and du reporting on space taken up by files and directories. About the AuthorRoss Moffatt has been a UNIX system administrator for 10+ years and can be contacted at ross.stuff@telstra.com. |
Comments (1)
Jul 22, 2008
JimLatenser says:
In addition, to 'find' the particular offending process(es) with open but delet...In addition, to 'find' the particular offending process(es) with open
but deleted files you can use
find /proc/*/fd -type f -links 0 -exec ls -l {} \;
which looks for files with zero links, i.e. that have been deleted but
a running process still has the file open. Using the PID from the
/proc/<PID>/fd/xxxxx names returned you can determine if the process can be
restarted without a server reboot.
If run as a userid other than root, there will be numerous error messages
when trying to access process directories not associated with your id.