SUMMARY: /var, df, du and the case of the missing space...

From: Brett Sondrup (
Date: Wed Oct 11 2000 - 11:28:00 CDT

First, my gratitude to all who took a moment to help me with this.

Problem revisited var was filling up but not full:
'du-sk' on /var says 16948
'df -k' on /var says that 132668kb of 140815kb is used leaving 8007kb
free... I'm no math whiz, but that don't add up. I was aware of the
differences between 'du' and 'df' but that knowledge wasn't shedding any
light on finding out what was wrong.

I had asked if I could safely umount /var and run 'fsck' on it to check for
errors. Most said "good idea" but only as a next to last resort (last being
a fs dump, format and restore of /var). Nearly everyone thought the problem
was a log file that had been deleted whos inode was still being held open by
the originating process. Thus it would be that 'du' wouldn't see it and
'df' would.

Suggested solutions:
Check for free inodes, they were there.

Find out what files are open and being used by whom in /var. 'fuser -c
/var' and then 'ps -ef | grep' the process number (the c following the
number means "current", the o "open"). But there were quite a number of
files open making this a slow process.

Get 'lsof' from sunfreeware. The overwhelming majority, though uncertain as
to what might be the problem, know that 'lsof' would be the correct digging
tool. And it was.

Seems fbconsole was holding open a huge file. I tested a kill of fbconsole
on a safe box and then killed the offending process only to find that
fbconsole started another file. After a few minutes digging, I discovered
two ancient 'vxva' (Veritas Visual Administrator) sessions open. I killed
both and along with them the problem.

I'm still unclear on what fbconsole (fall back console) does, but that is
another question.

Again, thanks to all of you who replied.

Brett Sondrup
IT (760) 436-9698
RoweCom Information Quest (760) 436-0553
531 Encinitas Blvd, Suite 201
Encinitas, CA 92024

U BEFORE POSTING please READ the FAQ located at
. and the list POLICY statement located at
A To submit questions/summaries to this list send your email message to:
A To unsubscribe from this list please send an email message to:
E and in the BODY type:
R unsubscribe sun-managers
S Or
. unsubscribe sun-managers original@subscription.address
L To view an archive of this list please visit:

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:14:19 CDT