Freeing up space on the disks

RobinH

@stephenw10 Hmm not sure. Its on a virtual server.

Packages that I use are:
acme
haproxy
openvpn-client-export
PfBlockerNG (Disabled and not in use)
Status_Traffic_Totals
System_Patches
Telegraf

stephenw10

Hmm, well I would have guessed pfBlocker was most likely but it's disabled.

Are you sure /var is not shown in that output? It wasn't just omitted in the copy/paste?

It doesn't look like you have it running as a ram disk so I expect it to be there.

RobinH

@stephenw10 I got this when I ran the "du -Pshx /*" command, and can se the /var

8.0K /COPYRIGHT
1.3M /bin
426M /boot
116M /cf
0B /conf
12K /conf.default
3.0K /dev
4.0K /entropy
7.9M /etc
260K /home
12M /lib
192K /libexec
4.0K /media
4.0K /mnt
4.0K /net
4.0K /proc
11M /rescue
381M /root
4.9M /sbin
0B /sys
92M /tmp
1.4G /usr
685M /var

stephenw10

Hmm, yet it doesn't show in du -h -d1 / ?

Is it mounted separately somehow?
What does mount -p show?

RobinH

@stephenw10 This is the output I get:

/dev/ufsid/5edf741a475fe581 / ufs rw,noatime 1 1
devfs /dev devfs rw 0 0
tmpfs /var/run tmpfs rw 0 0
tmpfs /var/run tmpfs rw 0 0
devfs /var/dhcpd/dev devfs rw 0 0

stephenw10

Hmm, what about df -a ?

RobinH

@stephenw10 When using the df -a command I get:

Filesystem                  512-blocks     Used   Avail Capacity  Mounted on
/dev/ufsid/5edf741a475fe581   38557496 27083392 8389512    76%    /
devfs                                2        2       0   100%    /dev
tmpfs                             8192     2488    5704    30%    /var/run
tmpfs                             8192     2920    5272    36%    /var/run
devfs                                2        2       0   100%    /var/dhcpd/dev

stephenw10

Hmm, then why doesn't it show in du -h -d1 /

I'll still bet it's in /var try: du -h -d1 /var

RobinH

@stephenw10 When I run the "du -h -d1 /var" command I get this:

4.0K /var/msgs
1.3M /var/run
12K /var/audit
4.0K /var/backups
4.0K /var/preserve
4.0K /var/crash
4.0K /var/mail
4.0K /var/heimdal
4.0K /var/account
425M /var/db
241M /var/cache
4.0K /var/yp
32K /var/spool
4.0M /var/tmp
8.0K /var/cron
4.0K /var/rwho
4.0K /var/games
4.0K /var/authpf
3.2M /var/log
64K /var/unbound
12K /var/at
4.0K /var/empty
7.6M /var/etc
4.4M /var/dhcpd
8.0K /var/lib
687M /var

stephenw10

Hmm, not there then. So there's ~10GB being used somewhere in that device that just isn't shown mounted filesystem...

Try gpart list see if that shows the expected values.

RobinH

@stephenw10 Here is the "gpart lis" output

Geom name: da0
modified: false
state: OK
fwheads: 255
fwsectors: 63
last: 125829119
first: 63
entries: 4
scheme: MBR
Providers:

Name: da0s1
Mediasize: 21474803200 (20G)
Sectorsize: 512
Stripesize: 0
Stripeoffset: 32768
Mode: r2w2e5
efimedia: HD(1,MBR,0x90909090,0x40,0x27fffbf)
attrib: active
rawtype: 165
length: 21474803200
offset: 32768
type: freebsd
index: 1
end: 41943038
start: 64
Consumers:
Name: da0
Mediasize: 64424509440 (60G)
Sectorsize: 512
Mode: r2w2e7

Geom name: da0s1
modified: false
state: OK
fwheads: 255
fwsectors: 63
last: 41942974
first: 0
entries: 8
scheme: BSD
Providers:

Name: da0s1a
Mediasize: 20401094656 (19G)
Sectorsize: 512
Stripesize: 0
Stripeoffset: 32768
Mode: r1w1e2
rawtype: 7
length: 20401094656
offset: 0
type: freebsd-ufs
index: 1
end: 39845887
start: 0
Name: da0s1b
Mediasize: 1073708032 (1.0G)
Sectorsize: 512
Stripesize: 0
Stripeoffset: 3221258240
Mode: r1w1e1
rawtype: 1
length: 1073708032
offset: 20401094656
type: freebsd-swap
index: 2
end: 41942973
start: 39845888
Consumers:
Name: da0s1
Mediasize: 21474803200 (20G)
Sectorsize: 512
Stripesize: 0
Stripeoffset: 32768
Mode: r2w2e5

stephenw10

Hmm, is there some huge coredump file directly in the root of / that's somehow not being counted?

RobinH

@stephenw10 hmm could be?
How do I check that or should I just peform a delete_coredump?

stephenw10

I would just look in it manually: ls -ls /

Coredumps are usually in /root though so check there too: ls -ls /root

RobinH

@stephenw10 ls -ls / gave me this:

total 65833
    8 drwx------   2 root  wheel          512 Aug 25  2020 .cache
    8 -rw-r--r--   2 root  wheel         1023 Jan 31  2022 .cshrc
    8 -rw-r--r--   2 root  wheel         1067 Oct 18  2022 .profile
    8 drwxrwxr-x   2 root  operator       512 Jun  9  2020 .snap
65600 -r--------   1 root  wheel     33554432 Jun  9  2020 .sujournal
   16 -r--r--r--   1 root  wheel         6121 Jan 31  2022 COPYRIGHT
    8 drwxr-xr-x   2 root  wheel         1024 Oct 18  2022 bin
    8 drwxr-xr-x  11 root  wheel         1536 Oct 18  2022 boot
    8 drwxr-xr-x   3 root  wheel          512 Jan 31  2022 cf
    0 lrwxr-xr-x   1 root  wheel            8 Mar 24  2020 conf -> /cf/conf
    8 drwxr-xr-x   2 root  wheel          512 Jan 31  2022 conf.default
    1 dr-xr-xr-x  12 root  wheel          512 Oct 18  2022 dev
    8 -rw-------   1 root  wheel         4096 Jun  9  2020 entropy
   16 drwxr-xr-x  28 root  wheel         4608 Jun 22 23:38 etc
    8 drwxr-xr-x  17 root  wheel          512 Jun 22 23:38 home
    8 drwxr-xr-x   5 root  wheel         1536 Oct 18  2022 lib
    8 drwxr-xr-x   3 root  wheel          512 Oct 18  2022 libexec
    8 drwxr-xr-x   2 root  wheel          512 Mar 24  2020 media
    8 drwxr-xr-x   2 root  wheel          512 Mar 24  2020 mnt
    8 drwxr-xr-x   2 root  wheel          512 Jan 31  2022 net
    8 dr-xr-xr-x   2 root  wheel          512 Mar 24  2020 proc
    8 drwxr-xr-x   2 root  wheel         2560 Oct 18  2022 rescue
    8 drwxr-xr-x   4 root  wheel          512 Jun  2 09:48 root
    8 drwxr-xr-x   2 root  wheel         2560 Oct 18  2022 sbin
    0 lrwxr-xr-x   1 root  wheel           11 Mar 24  2020 sys -> usr/src/sys
   32 drwxrwxrwt   7 root  wheel        15360 Jun 26 15:38 tmp
    8 drwxr-xr-x  13 root  wheel          512 Jan 31  2022 usr
    8 drwxr-xr-x  27 root  wheel          512 Jan 31  2022 var

RobinH

@stephenw10 And the ls -ls /root gave me this:

total 781128
     8 drwx------  3 root  wheel        512 Oct 18  2022 .cache
     8 -rw-r--r--  2 root  wheel       1023 Jan 31  2022 .cshrc
     0 -rw-r--r--  1 root  wheel          0 Oct 18  2022 .hushlogin
     8 -rw-r--r--  1 root  wheel         80 Jan 31  2022 .k5login
     8 -rw-r--r--  1 root  wheel        328 Jan 31  2022 .login
     8 -rw-r--r--  2 root  wheel       1067 Oct 18  2022 .profile
     8 -rw-------  1 root  wheel       1024 Jun 21 13:52 .rnd
     8 -rw-r--r--  1 root  wheel       1943 Oct 18  2022 .shrc
     8 -rw-r--r--  1 root  wheel       3090 Oct 18  2022 .tcshrc
 68992 -rw-------  1 root  wheel   35291136 Sep  4  2020 charon.core
     8 -r-xr-xr-x  1 root  wheel       1124 Dec 19  2022 disconnect.sh
544832 -rw-------  1 root  wheel  278818816 Jul 22  2020 ntopng.core
    56 -rw-r--r--  1 root  wheel      24614 Jun  2 09:50 packetcapture.cap
     0 -rw-r--r--  1 root  wheel          0 Jun  2 09:47 packetcapture.start
167168 -rw-------  1 root  wheel   85536768 Oct 19  2022 php-cgi.core
     8 drwxr-xr-x  2 root  wheel        512 Aug 18  2020 scripts

Seems like the .core files are bigger?

stephenw10

Yes, but still only 100s of MBs not GBs. You can remove those core files though.

RobinH

@stephenw10 Weird. I don't understand where 10GB would lie undetected.

How do I remove .core from root?

stephenw10

Indeed, I'm not sure here that space is being used.

You can remove those files from the command line as root or at Diag > Command Prompt like: rm /root/ntopng.core
Obviously be careful doing that!

Steve

RobinH

@stephenw10 Got 2% less... (77 to 75%)
Dont really know what to do more then the things you suggested.

There must be something that stores those 10GB's..