[Tfug] disk usage mystery..

[JD Rogers]

> If you have the time, I would suggest rebooting (or using telinit to
> switch) into a single user run level.  Then you should just have the
> kernel, init, and your shell running.  If it is *still* leaking, then
> it seems that perhaps you have a kernel bug?

Not a bad idea.. I may try that when I can.. probably wednesday.

[snip]
> Here's another shot in the dark: if it *is* in fact a kernel file
> system bug, then perhaps it is related the the ext4 journal?  I should
> think it has a relatively small maximum size, but maybe it is growing
> out of control and this data is released by an unmount?  Seems like
> you would encounter other effects from this, though.
>
> Another unlikely but possible culprit could be ecryptfs.  You didn't
> say if /home (or wherever the encrypted data is stored) is on its own
> partition.  If it is sharing space with root, maybe it's using up the
> extra space somehow?

I'm leaning towards ecryptfs. Sheepishly, I must admit I didn't notice
this earlier.. I am apparently also getting bazillions of these in my
logs:
[ 8923.440844] Valid eCryptfs headers not found in file header region
or xattr region
[ 8923.440849] Either the lower file is not in a valid eCryptfs
format, or the key could not be retrieved. Plaintext passthrough mode
is not enabled; returning -EIO

I found a few bug reports that mostly seem to be duplicates of
https://bugs.launchpad.net/ecryptfs/+bug/509180
but my symptoms are not really the same, and this might be totally
unrelated, because these errors stop when I close firefox. Yet the
disk usage does not resolve itself.

It appears I have some more digging to do. At least I feel like I have
some things to try. Thanks for the suggestions!