Over 100% disk usage

thinair

On the system screen, I have 109% percent disk usage.
I started to cringe when I noticed it at 99%, but then I figured I'd let it go and document what happens when the disk hit 100%. Well, nothing happens, apparently an extra 9% of bits are stockpiled around the harddrive somewhere.

Sidenote: it's a 30GB harddrive, I'm running ntop, which is why I'm assuming the disk is filling so fast.
I'd post a screen cap but I figure it's pretty self explanitory. Also, the 'progress bar' is 9% longer then the CPU/Mem/Swap bars.

sullrich

Do a df -h -d1 / from a shell to get a breakdown

thinair

Output from df -h:
Filesystem Size Used Avail Capacity Mounted on
/dev/ad0s1a 27G 27G -2.1G 109% /
devfs 1.0K 1.0K 0B 100% /dev
/dev/md0 1.7M 36K 1.5M 2% /var/run
devfs 1.0K 1.0K 0B 100% /var/dhcpd/dev

adding -d1 returns an illegal operation error.

sullrich

Sorry that should be:

du -h -d1 /

dotdash

Seeing over 100% in disk usage is due to the way FreeBSD calculates the free space.
From the FreeBSD FAQ:
9.27. How is it possible for a partition to be more than 100% full?
A portion of each UFS partition (8%, by default) is reserved for use by the operating system and the root user. df(1) does not count that space when calculating the Capacity column, so it can exceed 100%. Also, you will notice that the Blocks column is always greater than the sum of the Used and Avail columns, usually by a factor of 8%.

hoba

What version is this? Also what packages are you running?

thinair

Ok, I just tried the du -h -d1 / command.
2.0K /.snap
5.2M /boot
780K /bin
1.5K /dev
16K /conf.default
2.3M /etc
158K /libexec
3.4M /lib
25M /root
1.9M /sbin
118M /usr
27G /var
686K /tmp
2.0K /mnt
2.9M /cf
2.0K /media
2.0K /proc
2.0K /rescue
12K /scripts
27G /

I'm using the March 23rd snapshot, the only package I have installed is ntop. The harddrive is pretty close to be full now, the ntop service has stopped running on its own. I'm not receiving any errors in the log except when I try to start ntop again. I do plan to format and reinstall from the stable release and upgrade to the latest snapshot….eventually.

sullrich

Now do:

do -d1 -h /var/

thinair

2.0K /var/account
6.0K /var/at
2.0K /var/audit
2.0K /var/backups
4.0K /var/crash
4.0K /var/cron
27G /var/db
2.0K /var/empty
2.0K /var/games
2.0K /var/heimdal
1.5M /var/log
2.0K /var/mail
2.0K /var/msgs
2.0K /var/named
2.0K /var/preserve
36K /var/run
2.0K /var/rwho
14K /var/spool
4.0K /var/tmp
2.0K /var/yp
58K /var/etc
1.4M /var/dhcpd
46K /var/installer_logs
27G /var/

sullrich

Okay now:

du -h /var/db/

thinair

du -h /var/db/
2.0K /var/db/entropy
2.0K /var/db/ipf
892K /var/db/pkg
2.0K /var/db/ports
2.0K /var/db/portsnap
2.9M /var/db/rrd
2.0K /var/db/freebsd-update
2.0K /var/db/pingstatus
2.0K /var/db/pingmsstatus
27G /var/db/ntop
27G /var/db/

du -h /var/db/ntop
27G /var/db/ntop/rrd
27G /var/db/ntop

du -h /var/db/ntop/rrd/
2.0K /var/db/ntop/rrd/graphics
4.0K /var/db/ntop/rrd/flows
27G /var/db/ntop/rrd/interfaces
27G /var/db/ntop/rrd

du -h /var/db/ntop/rrd/interfaces
14G /var/db/ntop/rrd/interfaces/xl0
12G /var/db/ntop/rrd/interfaces/xl1
393M /var/db/ntop/rrd/interfaces/ath0
27G /var/db/ntop/rrd/interfaces

Ok, take your pick :P

sullrich

Well, there it is, NTOP hogging it all. I would recommend deleting that /var/db/ntop directory and starting over. That is interesting that it does not recycle its logs!?

billm

Looks like it's the ntop rrd files. ouch!

–Bill