Filled up the filesystem. How?

[dan]

Dotan Cohen wrote:
> On 6/8/05, Alexander Dalloz <ad+lists at uni-x.org> wrote:
> 
>>Am Di, den 07.06.2005 schrieb Dotan Cohen um 23:39:
>>
>>
>>>Last week I wrote that I somehow filled 7 out of 10 megs in my linux
>>>partition. Today that last bit was filled- I am at 100% capacity.
>>>
>>>I cannot download email or create new files. What could be the cause
>>>of this? Where should I look for bloat? What can I delete?
>>>
>>>Dotan
>>
>>This can easily be happen if log files fill very quickly. I.e. if you
>>have Apache running, a fault in your page and quite some hits, the
>>error_log can grow rapidly. So watch out for large log files.
>>
>>Alexander
>>
>>
>>--
>>Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773
>>legal statement: http://www.uni-x.org/legal.html
>>Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.27_FC2smp
>>Serendipity 23:54:54 up 14 days, 22:32, load average: 0.38, 0.53, 0.49
>>
>>
>>BodyID:69189987.2.n.logpart (stored separately)
>>
>>
> 
> 
> /var/logs is 23 megs (same as last week) 
> /var is 1.3 gigs (same as last week)
> /usr is 3.7 gigs (same as last week)
> /proc is 480 megs (same as last week)
> 
> I only checked those because those were the biggies last week. The
> system is so slow now that it takes a long time for it to caculate
> those values. Where else should I look?
> 
> Dotan
> 

Dotan -

Can you show us an output of:

/sbin/fdisk -l|df -i

The reason I ask is ebcause I've seen a machine that had been out of 
inodes, as seen by this output.  Pay attention to the "IUse%" column, 
which may provide clues.  If this is the case, /var/log/messages will 
hint at this.

When a disk is formatted, each unit is designated an allocation size. 
There is one inode for this allocation block size.  If your block size 
is, for example, 4096k, and you have a file that is 2k, then you will 
have used one inode.  You can see how this would be a problem if you had 
hundreds of thousands of very small files, which would make your system 
*think* that it's low on space, just because inodes are not being used 
efficiently.  I've seen this many times on compromised mail servers 
where a spammer has queued up millions of tiny email messages.

Hope that helps
-dant