0

What is the best way to identify the cause of root space utilization. Even after restart my machine it is only showing 2.2G available in my machine.

What are the possibilities 

# df -h
Filesystem             Size  Used Avail Use% Mounted on
/dev/mapper/rhel-root   50G   48G  2.2G  96% /
devtmpfs               6.8G     0  6.8G   0% /dev
tmpfs                  6.8G  420K  6.8G   1% /dev/shm
tmpfs                  6.8G   17M  6.8G   1% /run
tmpfs                  6.8G     0  6.8G   0% /sys/fs/cgroup
/dev/mapper/rhel-home  408G  210G  198G  52% /home
/dev/sda1              497M   96M  401M  20% /boot

I tried this ncdu / and got this 

    9.1 GiB [          ] /usr
    1.2 GiB [          ] /var
  806.2 MiB [          ] /root
  193.2 MiB [          ] /opt
  167.5 MiB [          ] /run
   70.6 MiB [          ] /boot
   26.8 MiB [          ] /etc
  420.0 KiB [          ] /dev
  168.0 KiB [          ] /tmp
  164.0 KiB [          ]  open.txt
   64.0 KiB [          ]  .readahead
.   0.0   B [          ] /proc
    0.0   B [          ] /sys
@   0.0   B [          ]  lib64
@   0.0   B [          ]  sbin
@   0.0   B [          ]  lib
@   0.0   B [          ]  bin
e   0.0   B [          ] /srv
e   0.0   B [          ] /mnt
e   0.0   B [          ] /media
    0.0   B [          ]  .autorelabel

which shows that total space not exceeding apporx 13G. Still I am getting 49G as total used space.

hildred
  • 5,829
  • 3
  • 31
  • 43
decimal
  • 169

2 Answers2

2

"Best" is very subjective, but there are many options. Here are a few:

  • graphical: baobab, KDirStat
  • curses: ncdu (as recommended by @Pablo-Hinojosa)
  • non-interactive command line: see below.

I deal with server environments a lot, so I generally prefer simple non-interactive approaches that will run anywhere without installing anything. E.g. my usual approach would be:

du -max / | grep -P '^\d{4}' | sort -rn

This will usually take a while to run, so I'd usually pipe the output into a file, and come back in a while. On some systems I run this periodically from cron so that I can look at the changes over time.

EDIT: so now you have added info that the files in your file system don't add up to the total file usage. Sounds like you have a large anonymous file in play. I.e an open file which has been deleted. A brutal approach would be to reboot, but you can also identify the file by looking through proc. I'm on my phone, but from memory, list the files in /proc/[0-9]*/fd and look for big ones. You can use that to identify the process with the large file, and look at the content of it. lsof might also be useful.

mc0e
  • 1,086
  • du -max / | grep -P '^\d{4}' | sort -rn 11571 / 9348 /usr 5168 /usr/local 4804 /usr/local/lib 2010 /usr/share 1197 /var 1195 /usr/lib64 , I tried but still not able to figure out actual things. – decimal Sep 21 '15 at 03:35
  • Those numbers are the sizes of the largest directories in the root file system in megabytes – mc0e Sep 22 '15 at 08:00
1

Take a look at ncdu On Debian family distros is on the repositories. On Red Hat family distros it is on EPEL. So: 

apt-get install ncdu

or 

yum install epel-release
yum install  --enablerepo=epel ncdu

Otherwise, you can always build it from source

Then, just type 

ncdu /
Community
  • 1
Pablo Hinojosa
  • 189