| === sdeziel_ is now known as sdeziel | ||
| foo | I've deleted multiple files on a ubuntu server, the storage isn't free'ing up, we are at max storage space. df -h not showing free space. I've done lsof and I cannot find a process using the old log files, nothing should be using it. Any suggestions? | 15:34 |
|---|---|---|
| foo | ananke / JanC - thank you. I had a tail command blocking the process and the file was deleted. What was confusing to me is I explicitly checked lsof|grep filename... I would have expected the tail command to show in there, it did not | 15:54 |
| minimal | foo: well the filename no longer existed once you deleted it (the tail process however kept a FD open pointing to the file however) | 16:01 |
| minimal | this is a "trick" that for example some malware use to hide themselves | 16:02 |
| minimal | foo: the "rm" command simply calls the unlink() system call, to quote from its manpage: "unlink() deletes a name from the filesystem. If that name was the last link to a file and no processes have the file open, the file is deleted and the space it was using is made available for reuse." | 16:04 |
| JanC | minimal: in some cases lsof will still show the old file name with "(deleted)" appended | 16:10 |
| JanC | but these things can be complicated indeed, and in general deleting files is no guarantee storage space is deleted | 16:12 |
| JanC | even after the inode no longer exists in some cases | 16:13 |
| JanC | especially in more modern file systems | 16:13 |
| minimal | back in the day the "correct" method we used to free up diskspace was ":> filename" to truncate files (so freeing up space) without changing the FD (and so not affecting "tail" etc) | 16:17 |
| patdk | heh, I had the issue last week, freed up 20gigs of data I dont use to make space | 16:42 |
| patdk | but had no impact, due to the file cache just dumped 20gigs of new data to logs | 16:42 |
| JanC | minimal: that would not help in case of sparse files, deduplicated storage (e.g. snapshots), etc. | 16:54 |
| JanC | in fact, truncating files might require extra storage in some cases... | 16:55 |
| === y0sh- is now known as y0sh_ | ||
| === Wyly0 is now known as Wyly | ||
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!