[Tfug] disk usage mystery..

[JD Rogers]

Hmm, I think both of you are right on track. I was mistakenly under
the impression that files that were in use by programs actually showed
up with du. Apparently not.

>> This is just a shot in the dark, but perhaps you have some broken
>> process (either a bug or something more malicious) that is filling up
>> the space with temp files.  It is not uncommon for a process to create
>> a random temp file, open it, then unlink it.  At this point, the
>> process can still use the file for storage but nobody else should be
>> able to open the file because it will not be listed on the file
>> system.  As soon as the process closes the file, the final link is
>> released and the data is finally deleted.

John, from what you know, do these files get released when the program
is closed? I was just killing off programs and processes to see if I
could find one that gives me disk back, but so far nothing I've found
helps (except reboot). Which, unfortunately, I just did, so I can't
try Ian's suggestion yet.

> Presumably 'lsof | grep "(deleted)"' when disk usage is high will show
> such files (and, conveniently, the processes with the open links). I had
> a similar disk-usage problem situation recently (fixed by changing a
> script's configurable tmpdir), but didn't make the connection.

I'll try that as soon as I see my free space plummet. At ten minutes
after reboot, I have 19 of  of these deleted files, mostly gvfs
related. Not sure that isn't normal.

>
> On my system I get a number of false positives here that actually exist
> (e.g. /usr/bin/xinit, which clearly still exists on my system!).
> However, it's pretty easy to check if you can see a given file.
>
> I know from experience that df will see this disk usage; du may not,
> since it's file-oriented rather than partition-oriented. You might also
> check if du and df differ substantially in their numbers; that might
> suggest John is on the right track.

Heh, ya du and df differ.. 37GB vs 62GB used.. but that is mostly
because the homedir is ecryptfs and gets remounted, essentially gets
double counted by du. I'll try again without -h and get better numbers
to verify that these are indeed seeing different usage.

Thanks to both of you for the suggestions,
JDR