Harddisk Space error

t.hollenbeck

Good Morning

Over the christmas holidays the harddisk of pfsense runs full. The most space used by squid. I clear the local squid cache to become some space.

Then I look what df said.

Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/ufsid/55dc5fae06c07251 21G 15G 4.3G 78% 41k 2.8M 1% /
devfs 1.0K 1.0K 0B 100% 0 0 100% /dev
/dev/md0 3.4M 180K 3.0M 6% 52 970 5% /var/run
devfs 1.0K 1.0K 0B 100% 0 0 100% /var/dhcpd/dev

I search for big files with the help of "du" but nothing to find. The next step I reboot the system.
After the reboot df said

Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/ufsid/55dc5fae06c07251 21G 1.3G 18G 7% 41k 2.8M 1% /
devfs 1.0K 1.0K 0B 100% 0 0 100% /dev
/dev/md0 3.4M 168K 3.0M 5% 49 973 5% /var/run
devfs 1.0K 1.0K 0B 100% 0 0 100% /var/dhcpd/dev

My question now, where is the error, that used the disk space?

Pfsense runs von Vmware 6.0

Thanks
(and forgive me vor my bad english)

muswellhillbilly

What packages other than Squid do you have installed? In my own experience, Ntop for example can use up a lot of disk space relatively quickly.

t.hollenbeck

I use pfsense 2.2.5
with these packages

Open-VM-Tools System
Installed: 1280544.12

Postfix Forwarder
Installed: 2.4.5

squid3 Services
Installed: 0.4.2

Here is the actual output of "du". But theire are no big differences to the output today before the reboot.

du -h -d 1
4.0K ./.snap
19M ./boot
1.0M ./bin
12K ./conf.default
3.0K ./dev
9.1M ./etc
24K ./home
14M ./kernels
304K ./libexec
9.0M ./lib
316K ./root
3.7M ./sbin
803M ./usr
544M ./var
4.1M ./tmp
4.0K ./mnt
7.8M ./cf
4.0K ./media
4.0K ./proc
4.0K ./rescue
4.0K ./scripts
4.0K ./tank
1.4G .

muswellhillbilly

It would be best to run your du command when your drive is showing full or nearly full usage. You can then drill down through the directory showing the most use until you get to the directory where the space is being used up. Otherwise it's anyone's guess where your space is being eaten up. Squid might be the culprit, though if your Postfix settings aren't correct your firewall might be queuing large amounts of undelivered mail - possibly system warnings(?).