Solaris

df shows that the filesystem is filling up and the usage is 94%.
However when I actually traverse to the directory I du shows only about
10% of the space occupied!

Below is the output of df and du:
>>>df -kh
/cbmdata/00 470M 393M 29M 94% /cbmdata/00

>>>/cbmdata/00> du -sh *
57K billing
1K config
48M coreEMS
1.7M data
115K gdd
8K lost+found
4K sba

I am wondering how the hell is filesystem is so full!
Any pointers of what to look for and how would be a great help!

Thanks a lot.

A process can open file, then unlink it. The file "disappears" to other users. As long as the file is held open by the originating process, the data exists on disk. Even if you cannot see it. It is a nice security measure. Plus the file goes away when the process closes it or exits.

That may be your problem.

Code:

lsof | grep  'cbmdata/00'

will show open files - if you have fuser instead you can try that. If there are no identifable large files look for files that do not show up in ls.

One cause I see a lot of is someone 'removing', moving or clearing log files. Often someone will do an 'rm' of a log file which is held open. While the file will disappear from the file system ('ls' will not display it) it is still there and being written to by some process.

Also, do a find by size. It is possible that you are not looking at '.' files as the "*" in your example will not display '.' files.

find /cbmdata/00 -size +10000000c

Thanks for your replies!

I figured out that the mount point was not empty by itself!
The mount point itself had about 300MB of data.
I unmounted the filesystem and checked for disk usage and bingo!
There it was!