Skip to: Site menu | Main content

Blog > Who ate my disk?

>> Who ate my disk?

Thu, Feb 7th 9:08am 2008: Linux

I'm confuzzled. Something is eating up disk on one of my VMs, and I can't figure out what. On a machine that isn't even in active use because it's only accessed every week or so for demos, and which should have way less than 50% disk utilisation:

root@intra-174:/# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/hda2 20G 18G 1.6G 92% /
varrun 193M 176K 192M 1% /var/run
varlock 193M 4.0K 193M 1% /var/lock
udev 193M 24K 193M 1% /dev
devshm 193M 0 193M 0% /dev/shm


Getting tight. So let's see where all that disk is being used:

root@intra-174:/# du -h --max-depth=1
16K ./lost+found
3.4M ./bin
33M ./boot
4.0K ./cdrom
3.0M ./dev
36M ./etc
4.0K ./floppy
260K ./home
4.0K ./initrd
168M ./jade
262M ./lib
4.0K ./media
4.0K ./mnt
4.0K ./opt
395M ./proc
226M ./root
9.8M ./sbin
483M ./sitebuilder
481M ./srv
0 ./sys
202M ./tmp
1.9G ./usr
1.5G ./var
5.6G .


Umm, what the hell? 5.6G != 18G.

At linux.conf.au I had a quick chat to Tony Breeds and Steve Hanley about it, who both speculated that the problem could be sparse file preallocation being reported by du. So let's have a look:

root@intra-174:/# du -h --apparent-size --max-depth=1
16K ./lost+found
3.2M ./bin
32M ./boot
4.0K ./cdrom
244K ./dev
29M ./etc
4.0K ./floppy
144K ./home
4.0K ./initrd
168M ./jade
241M ./lib
4.0K ./media
4.0K ./mnt
4.0K ./opt
393M ./proc
226M ./root
9.4M ./sbin
482M ./sitebuilder
273M ./srv
13M ./sys
199M ./tmp
1.7G ./usr
1.5G ./var
5.1G .


The odd thing is that rebooting this VM drops the reported disk usage in df back down under 6G, then it starts creeping back up again at about a gig per day.

Any ideas?