Topic: df says 0 space, du says only 5G is used

[mike_mattos]

a machine is filling the drive as fast as I clear space but du says only 5.0G in /.

any suggestions? 

[Stefano]

df -i?

Code: [Select]

cd /
du -s -m * | sort -n -r


[piran]

a machine is filling the drive as fast as I clear space

Apparently there's an HTML5 issue that 'can' do so similarly...
http://www.theverge.com/2013/3/1/4042728/html5-browser-exploit-could-let-pranksters-fill-up-your-hard-drive

[mike_mattos]

after stopping squid

squid -z
echo "" > var/spool/squid/swap.state

tried to restart squid
squid appeared not to restart, (status down ) and the drive continued to fill, so I went off to prepare a replacement system.  AN hour later, before I headed out to the client, I checked and found squid was running and the hard drive back to less than 10% used

The HTML5 exploit sounds reasonable, but the article suggests it is the client drive filling up, not the web server.

[mike_mattos]

Stefano, Piran, the du output showed no large files, nothing showed more than the expected 10% usage.  No hints on why the other 90% was 'used'.

HOWEVER, searching for recently modified files found more files in squid than my terminal buffer holds!

/var/spool/squid/00/00 and dozens of other directories were full of 50K files, all created in the last week, and some current.

[piran]

The HTML5 exploit sounds reasonable, but the article suggests it is the client drive filling up, not the web server.

How would I know with the dearth of details provided:-)
All my (client) sites are on my own server's iBays.

Perhaps someone has installed say a backup mechanism
that is backing up its own backup files thus filling up etc.

[mike_mattos]

piran, I didn't find/remove any files larger than 50MB, maybe cleaned out 1GB in logs and archives.  But  75GB came back to life by itself after letting squid z run for an hour.  I can't comment on the linked article other than what I read.   

From the article

 Microsoft Internet Explorer, Apple Safari, and Opera have no storage limit to keep pranksters from misbehaving. We tried FillDisk.com for ourselves on a Windows 8 machine with updated browsers, and sure enough, our drive started filling immediately

SO, the question is, if a PC is filling its drive, is squid making a cache copy of the crap going to the PC?

[piran]

You have provided no data, no details, no... anything.
Stephano and I have freely provided you vector possibilities.
Neither he nor I possess crystal balls. If you require us to
work in the dark don't be surprised when you find us asleep.

[CharlieBrady]

Files which are deleted, but still in-use by a running process, will occupy space but not show up in a du listing. Those are essentially anonymous files - they exist, but they don't have a name.

Also if you use '*', you won't catch any files or directories whose names start with '.'.

[mike_mattos]

I think you are right, Charlie.  The missing space files are now in the squid directories as zero space but the names persisted!  So squid obviously was still active.

Good catch on the dot and star, it wasn't an issue this time, but it could be in future.  The only way I found them was looking for active files!

Today using my development machine in /var/spool/squid  I now see 15761861 with lsof,  and 110068 with du, and on the problem system, 3949422 and 194872.  SO squid seems to have a backlog as a feature.

On the bright side, the instructions here on cleaning the squid cache worked, the only quibble would be to add a speedometer or some way to display the process completion.