Well, that was a good idea thanks for it, but no luck. I`ve killed and start
again every process listed in fstat but the amount of
used space has not drop. I`ve forgot to mention that I use 4.6-stable with
GENERIC kernel.

/dev/wd0a     1005M    274M    680M    29%    /



2009/12/18 Joachim Schipper <joachim@joachimschipper.nl>

quoted text
> On Fri, Dec 18, 2009 at 10:36:46AM +0200, Daniel Zhelev wrote:
> > Hello list.
> > I`ve set up a little bash script to tell me when some file system is
> > over 95% full and after a month I got a mail about my root file system
> > ( / ) after log in I sow that the root file system is over 100%. That
> > is fine I tried to do a search for big and nasty files and so on but
> > after a hour magically the file system was at 20%.  That got me very
> > worried about any security issue, but nothing was missing and so on.
> > The issue is that the file system continues to grow about a 2 presents
> > a day, which is strange.
>
> > Here is some output:
> >
> > Filesystem     Size    Used   Avail Capacity  Mounted on
> > /dev/wd0a     1005M    251M    704M    26%    /
> > /dev/wd0k     46.7G   26.0K   44.4G     0%    /home
> > /dev/wd0d      3.9G    8.0K    3.7G     0%    /tmp
> > /dev/wd0f      2.0G    615M    1.3G    32%    /usr
> > /dev/wd0g     1005M    145M    809M    15%    /usr/X11R6
> > /dev/wd0h      5.4G    206M    5.0G     4%    /usr/local
> > /dev/wd0i      2.0G    619M    1.3G    32%    /usr/src
> > /dev/wd0e      8.9G    585M    7.8G     7%    /var
> > /dev/wd0j      2.0G    961M    951M    50%    /usr/obj
> > /dev/wd1a      295G    562M    280G     0%    /storage/storages
> > /dev/wd1b      110G   20.7G   83.7G    20%    /storage/windows
> >
> > root@sgate:/root# find / -xdev -size +1000 -type f | xargs ls -laSh
> > -rwxr-xr-x  1 root  wheel   6.9M Nov 25 16:39 /bsd
> > -rw-r--r--  1 root  wheel   6.9M Nov 25 14:16 /obsd
> > -rw-r--r--  1 root  wheel   5.8M Nov 25 14:16 /bsd.rd
> > -r-xr-xr-x  1 root  bin     1.2M Dec  7 15:05 /sbin/isakmpd
> > -r--r--r--  1 root  bin     526K Dec  7 15:06 /etc/magic
> >
> > root@sgate:/root# find / -xdev -mtime -1 -type f | xargs ls -laSh
> > -rw-------  1 root  wheel   2.0K Dec 18 03:09 /etc/pf.conf
> > -rw-r--r--  1 root  wheel   507B Dec 18 03:08 /etc/hosts
> > -rw-r--r--  1 root  wheel     0B Dec 18 02:49 /etc/resolv.conf
>
> > The other strange thing is that I`ve set up the /etc/daily root backup
> > and here is the compare between two discs:
> >
> > /dev/wd1d     1005M   42.2M    912M     4%    /altroot
> > /dev/wd0a     1005M    251M    704M    26%    /
> >
> > since /altroot is exact dd copy of / isn`t they at the same size?
>
> It's quite possible that some process is holding open a file descriptor
> to a file which has no links from the filesystem. To see this, run 'vi
> bigfile', suspend, and run 'rm bigfile'. The space is still used. Then
> quit vi, and optionally run 'sync', and you'll see the space has been
> reclaimed.
>
> To see which process is the culprit, try fstat.
>
> (Note that this is only one possibility!)
>
>                Joachim