There is a common problem that there is a large open file that has been deleted. When a file is created, it writes an entry in the relevant directory so you can find it, but it is really a collection of disk blocks. The entry you can read in a directory is just a pointer to the disk blocks. The first block also contains what is called an i-node which holds information about the file, such as acces time, create time, modification time, permissions etc. Whilst the file is being written, those blocks will increase as the file needs.

If the file is still open as output by a program and someone issues a delete, all that will happen is that the directory entry that lets you see the file exists will get removed. The blocks are not freed until the file is closed, indeed the process can keep writing as long as there is space to write to.


Have a check of your manual pages for du to be sure, but you may be able to list it with:-

Code:

fuser -duV /nikira

This will hopefully give you the processes that have open and deleted files in the filesystem. You can then choose if you want to terminate them, which will release the space back to the filesystem.

if this is not correct, you may need to use lsof to list all open files in /nikira and then loop through to see which ones are files, directories or other items you can list, and which are just an i-node reference, something like:-

Code:

lsof | grep "/nikira$" | while read cmd pid userid fd type device offset inum fs
do
   file=`find /nikira -xdev -inum $inum`
   if [ "$file" = "" ]
   then
      echo "I-node $inum is not a file"
   fi
done

It will probably take a long time to run with such a loop. Perhaps this will give better performance:-

Code:

ls -laiR /nikira > /tmp/nikira_ls-laiR
lsof | grep "/nikira$" | while read cmd pid userid fd type device offset inum fs
do
   grep -q "^$inum " /tmp/nikira_ls-laiR
   if [ $? -ne 0 ]
   then
      echo "I-node $inum is not a file"
   fi
done

..... but if there are submounted filesystems of perhaps symbolic links, that may be a problem as the i-node you are chasing may be used in the sub-mounted filesystem and therefore will provide a listing in /tmp/nikira_ls-laiR


Robin