# my slice fill up with files



## vlad2005 (Nov 20, 2008)

Hi!
I have an strange situation. With "df -h", i see that my slice, monted on /var, have occupied space that increase every day.
But when i give "du -c -sh -L /var", i see another size, and grow more slowly.
Where are these files?

```
#df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/ad0s1a    496M    242M    214M    53%    /
devfs          1.0K    1.0K      0B   100%    /dev
/dev/ad0s1e    496M    264K    456M     0%    /tmp
/dev/ad0s1f     68G    4.8G     58G     8%    /usr
/dev/ad0s1d    1.8G    1.1G    586M    65%    /var
devfs          1.0K    1.0K      0B   100%    /var/named/dev
```


```
#du -c -sh -L /var
457M    /var
457M    total
```
Space occupied by /var are 1.1G show by df and 457M show by du.


----------



## schizoid (Nov 20, 2008)

http://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/disks.html#DU-VS-DF - ?


----------



## vlad2005 (Nov 20, 2008)

ok, i restart my server, and now, df look ok and show same size like du.
But for future, how can resolve that, without restart server.
I restart all my daemons, before restarting server, without success.


----------



## Lowell (Nov 20, 2008)

You can use fstat(1) to find out what process is holding an open file handle on /var.  How you get the process to close the file handle depends on what application is running in that process.


----------



## gelraen (Nov 20, 2008)

vlad2005 said:
			
		

> ok, i restart my server, and now, df look ok and show same size like du.
> But for future, how can resolve that, without restart server.
> I restart all my daemons, before restarting server, without success.


You can try to run sync(8) few times if problem caused by softupdates delay.


----------



## schizoid (Nov 21, 2008)

i to have this bug.
when i restarting natd, df == du


----------



## keramida@ (Nov 21, 2008)

vlad2005 said:
			
		

> Hi!
> I have an strange situation. With "df -h", i see that my slice, monted on /var, have occupied space that increase every day. [...]
> Space occupied by /var are 1.1G show by df and 457M show by du.



This is commonly caused by a daemon keeping a log file open after it has been rotated away.  You can find which program has open files in /var with a variety of tools: fstat(1) in the base system, and lsof(1) from the ports are nice.

In newer FreeBSD releases (i.e. in FreeBSD 7-STABLE) you can also use the procstat(1) utility that Robert Watson wrote:


```
# procstat -fa | fgrep var/log
  623 pflogd              4 v r rwa--n--   1   46984 -   /var/log/pflog    
 1410 syslogd            13 v r -wa-----   1   61863 -   /var/log/messages 
 1410 syslogd            14 v r -wa-----   1       0 -   /var/log/security 
 1410 syslogd            15 v r -wa-----   1       0 -   /var/log/auth.log 
 1410 syslogd            16 v r -wa-----   1   77482 -   /var/log/maillog  
 1410 syslogd            17 v r -wa-----   1       0 -   /var/log/lpd-errs 
 1410 syslogd            18 v r -wa-----   1       0 -   /var/log/xferlog  
 1410 syslogd            19 v r -wa-----   1    2876 -   /var/log/cron     
 1410 syslogd            20 v r -wa-----   1    4849 -   /var/log/debug.log
 1410 syslogd            21 v r -wa-----   1       0 -   /var/log/ppp.log  
#
```


----------

