Over 100% disk usage

sullrich · Mar 29, 2007, 3:53 AM

Do a df -h -d1 / from a shell to get a breakdown

thinair · Mar 29, 2007, 4:00 AM

Output from df -h:
Filesystem Size Used Avail Capacity Mounted on
/dev/ad0s1a 27G 27G -2.1G 109% /
devfs 1.0K 1.0K 0B 100% /dev
/dev/md0 1.7M 36K 1.5M 2% /var/run
devfs 1.0K 1.0K 0B 100% /var/dhcpd/dev

adding -d1 returns an illegal operation error.

sullrich · Mar 29, 2007, 4:42 PM

Sorry that should be:

du -h -d1 /

dotdash · Mar 29, 2007, 5:38 PM

Seeing over 100% in disk usage is due to the way FreeBSD calculates the free space.
From the FreeBSD FAQ:
9.27. How is it possible for a partition to be more than 100% full?
A portion of each UFS partition (8%, by default) is reserved for use by the operating system and the root user. df(1) does not count that space when calculating the Capacity column, so it can exceed 100%. Also, you will notice that the Blocks column is always greater than the sum of the Used and Avail columns, usually by a factor of 8%.

hoba · Mar 29, 2007, 9:25 PM

What version is this? Also what packages are you running?

thinair · Mar 30, 2007, 2:33 PM

Ok, I just tried the du -h -d1 / command.
2.0K /.snap
5.2M /boot
780K /bin
1.5K /dev
16K /conf.default
2.3M /etc
158K /libexec
3.4M /lib
25M /root
1.9M /sbin
118M /usr
27G /var
686K /tmp
2.0K /mnt
2.9M /cf
2.0K /media
2.0K /proc
2.0K /rescue
12K /scripts
27G /

I'm using the March 23rd snapshot, the only package I have installed is ntop. The harddrive is pretty close to be full now, the ntop service has stopped running on its own. I'm not receiving any errors in the log except when I try to start ntop again. I do plan to format and reinstall from the stable release and upgrade to the latest snapshot….eventually.

sullrich · Mar 30, 2007, 6:22 PM

Now do:

do -d1 -h /var/

thinair · Mar 30, 2007, 7:34 PM

2.0K /var/account
6.0K /var/at
2.0K /var/audit
2.0K /var/backups
4.0K /var/crash
4.0K /var/cron
27G /var/db
2.0K /var/empty
2.0K /var/games
2.0K /var/heimdal
1.5M /var/log
2.0K /var/mail
2.0K /var/msgs
2.0K /var/named
2.0K /var/preserve
36K /var/run
2.0K /var/rwho
14K /var/spool
4.0K /var/tmp
2.0K /var/yp
58K /var/etc
1.4M /var/dhcpd
46K /var/installer_logs
27G /var/

sullrich · Mar 30, 2007, 8:01 PM

Okay now:

du -h /var/db/

thinair · Mar 30, 2007, 11:47 PM

du -h /var/db/
2.0K /var/db/entropy
2.0K /var/db/ipf
892K /var/db/pkg
2.0K /var/db/ports
2.0K /var/db/portsnap
2.9M /var/db/rrd
2.0K /var/db/freebsd-update
2.0K /var/db/pingstatus
2.0K /var/db/pingmsstatus
27G /var/db/ntop
27G /var/db/

du -h /var/db/ntop
27G /var/db/ntop/rrd
27G /var/db/ntop

du -h /var/db/ntop/rrd/
2.0K /var/db/ntop/rrd/graphics
4.0K /var/db/ntop/rrd/flows
27G /var/db/ntop/rrd/interfaces
27G /var/db/ntop/rrd

du -h /var/db/ntop/rrd/interfaces
14G /var/db/ntop/rrd/interfaces/xl0
12G /var/db/ntop/rrd/interfaces/xl1
393M /var/db/ntop/rrd/interfaces/ath0
27G /var/db/ntop/rrd/interfaces

Ok, take your pick :P

sullrich · Mar 31, 2007, 5:09 AM

Well, there it is, NTOP hogging it all. I would recommend deleting that /var/db/ntop directory and starting over. That is interesting that it does not recycle its logs!?

billm · Mar 31, 2007, 9:43 PM

Looks like it's the ntop rrd files. ouch!

–Bill