I have 2 questions:
1. I have noticed that my / partition's used space increased by ~10M from the last time I've checked it, from 111M to 121M. What could be the cause of that? (see the info below...)
2. The output of df and du is not what I am expecting it to be. I.e. there are differences between the disk usage reported by these 2 commands on the / partition. What could be the cause of this? (see the info below...)
Any reply or any RTFM re-dirrectioning is appreciated.
[root@guns /]# df -h Filesystem Size Used Avail Use% Mounted on /dev/ide/host0/bus0/target0/lun0/part5 189M 121M 68M 65% / none 235M 0 235M 0% /dev/shm tmpfs 235M 4.0K 235M 1% /tmp /dev/ide/host0/bus0/target0/lun0/part2 31M 5.2M 24M 18% /boot /dev/ide/host0/bus0/target0/lun0/part6 2.4G 713M 1.7G 30% /usr /dev/ide/host0/bus0/target0/lun0/part7 1.9G 374M 1.5G 20% /var /dev/ide/host0/bus0/target0/lun0/part8 57G 35G 23G 62% /home /dev/ide/host0/bus0/target0/lun0/part9 957M 486M 472M 51% /opt
[root@guns /]# ls bin boot dev etc home lib mnt opt proc root sbin sys tmp udev usr var
[root@guns /]# du -sh bin/ dev/ etc/ lib/ mnt/ proc/ root/ sbin/ sys/ tmp/ udev/ 2.8M bin/ 0 dev/ 5.5M etc/ 64M lib/ 0 mnt/ 481M proc/ 12M root/ 5.2M sbin/ du: cannot access `sys/bus/pci/drivers/Intel(R) 830M/845G/852GM/855GM/865G Framebuffer Driver': No such file or directory 0 sys/ 4.0K tmp/ 0 udev/
Here's my dmesg output in case it helps...
Linux version 126.96.36.199-ARCH (root@earth) (gcc version 3.4.3) #1 SMP Sat Apr 9 13:37:54 PDT 2005 BIOS-provided physical RAM map: BIOS-e820: 0000000000000000 - 000000000009fc00 (usable) BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved) BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved) BIOS-e820: 0000000000100000 - 000000001dffc000 (usable) BIOS-e820: 000000001dffc000 - 000000001dfff000 (ACPI data) BIOS-e820: 000000001dfff000 - 000000001e000000 (ACPI NVS) BIOS-e820: 00000000ffff0000 - 0000000100000000 (reserved) 0MB HIGHMEM available. 479MB LOWMEM available. On node 0 totalpages: 122876 DMA zone: 4096 pages, LIFO batch:1 Normal zone: 118780 pages, LIFO batch:16 HighMem zone: 0 pages, LIFO batch:1 DMI 2.3 present. ACPI: RSDP (v000 ASUS ) @ 0x000f6b10 ACPI: RSDT (v001 ASUS A7VI-VM 0x30303031 MSFT 0x31313031) @ 0x1dffc000 ACPI: FADT (v001 ASUS A7VI-VM 0x30303031 MSFT 0x31313031) @ 0x1dffc080 ACPI: BOOT (v001 ASUS A7VI-VM 0x30303031 MSFT 0x31313031) @ 0x1dffc040 ACPI: DSDT (v001 ASUS A7VI-VM 0x00001000 MSFT 0x0100000b) @ 0x00000000 ACPI: PM-Timer IO Port: 0xe408 Allocating PCI resources starting at 1e000000 (gap: 1e000000:e1ff0000) Built 1 zonelists Kernel command line: root=/dev/hda5 vga=773 ro Local APIC disabled by BIOS -- you can enable it with "lapic" mapped APIC to ffffd000 (013e3000) Initializing CPU#0 PID hash table entries: 2048 (order: 11, 32768 bytes) Detected 807.525 MHz processor. Using pmtmr for high-res timesource Console: colour dummy device 80x25 Dentry cache hash table entries: 65536 (order: 6, 262144 bytes) Inode-cache hash table entries: 32768 (order: 5, 131072 bytes) Memory: 480548k/491504k available (4086k kernel code, 10360k reserved, 1236k data, 288k init, 0k highmem) Checking if this processor honours the WP bit even in supervisor mode... Ok. Calibrating delay loop... 1597.44 BogoMIPS (lpj=798720) Security Framework v1.0.0 initialized Capability LSM initialized Mount-cache hash table entries: 512 (order: 0, 4096 bytes) CPU: After generic identify, caps: 0183f9ff c1c7f9ff 00000000 00000000 00000000 00000000 00000000 CPU: After vendor identify, caps: 0183f9ff c1c7f9ff 00000000 00000000 00000000 00000000 00000000 CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (64 bytes/line) CPU: L2 Cache: 64K (64 bytes/line) CPU: After all inits, caps: 0183f9ff c1c7f9ff 00000000 00000020 00000000 00000000 00000000 Intel machine check architecture supported. Intel machine check reporting enabled on CPU#0. Enabling fast FPU save and restore... done. Checking 'hlt' instruction... OK. ACPI: setting ELCR to 0200 (from 0e00) CPU0: AMD Duron(tm) Processor stepping 01 per-CPU timeslice cutoff: 182.83 usecs. task migration cache decay timeout: 1 msecs. SMP motherboard not detected. Local APIC not detected. Using dummy APIC emulation. Brought up 1 CPUs CPU0 attaching sched-domain: domain 0: span 1 groups: 1 domain 1: span 1 groups: 1 NET: Registered protocol family 16 PCI: PCI BIOS revision 2.10 entry at 0xf10c0, last bus=1 PCI: Using configuration type 1 mtrr: v2.0 (20020519) ACPI: Subsystem revision 20050228 ACPI: Interpreter enabled ACPI: Using PIC for interrupt routing ACPI: PCI Interrupt Link [LNKA] (IRQs 3 4 5 6 7 9 10 *11 12 14 15) ACPI: PCI Interrupt Link [LNKB] (IRQs 3 4 5 6 7 9 *10 11 12 14 15) ACPI: PCI Interrupt Link [LNKC] (IRQs 3 4 5 6 7 *9 10 11 12 14 15) ACPI: PCI Interrupt Link [LNKD] (IRQs 3 4 5 6 7 *9 10 11 12 14 15) ACPI: PCI Root Bridge [PCI0] (00:00) PCI: Probing PCI hardware (bus 00) PCI: Via IRQ fixup ACPI: PCI Interrupt Routing Table [_SB_.PCI0._PRT] ACPI: PCI Interrupt Routing Table [_SB_.PCI0.PCI1._PRT] Linux Plug and Play Support v0.97 (c) Adam Belay pnp: PnP ACPI init pnp: PnP ACPI: found 12 devices PnPBIOS: Disabled by ACPI PNP SCSI subsystem initialized PCI: Using ACPI for IRQ routing ** PCI interrupts are no longer routed automatically. If this ** causes a device to stop working, it is probably because the ** driver failed to call pci_enable_device(). As a temporary ** workaround, the "pci=routeirq" argument restores the old ** behavior. If this argument makes the device work again, ** please email the output of "lspci" to email@example.com ** so I can fix the driver. pnp: 00:02: ioport range 0xe400-0xe47f could not be reserved pnp: 00:02: ioport range 0xe800-0xe80f has been reserved pnp: 00:02: ioport range 0xe200-0xe27f has been reserved Simple Boot Flag at 0x3a set to 0x1 apm: BIOS version 1.2 Flags 0x03 (Driver version 1.16ac) apm: overridden by ACPI. VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) devfs: 2004-01-31 Richard Gooch (firstname.lastname@example.org) devfs: boot_options: 0x1 Installing knfsd (copyright (C) 1996 email@example.com). SGI XFS with ACLs, security attributes, no debug enabled SGI XFS Quota Management subsystem Initializing Cryptographic API Applying VIA southbridge workaround. PCI: Disabling Via external APIC routing vesafb: framebuffer at 0xf0000000, mapped to 0xde880000, using 1536k, total 32768k vesafb: mode is 1024x768x8, linelength=1024, pages=41 vesafb: protected mode interface info at c000:7f88 vesafb: scrolling: redraw vesafb: Pseudocolor: size=8:8:8:8, shift=0:0:0:0 Console: switching to colour frame buffer device 128x48 fb0: VESA VGA frame buffer device ACPI: Power Button (FF) [PWRF] ACPI: CPU0 (power states: C1[C1] C2[C2]) ACPI: Processor [CPU0] (supports 16 throttling states) isapnp: Scanning for PnP cards... isapnp: No Plug & Play device found Linux agpgart interface v0.100 (c) Dave Jones agpgart: Detected VIA Twister-K/KT133x/KM133 chipset agpgart: Maximum main memory to use for agp memory: 409M agpgart: AGP aperture is 64M @ 0xf8000000 [drm] Initialized drm 1.0.0 20040925 intelfb: Framebuffer driver for Intel(R) 830M/845G/852GM/855GM/865G chipsets intelfb: Version 0.9.2 serio: i8042 AUX port at 0x60,0x64 irq 12 serio: i8042 KBD port at 0x60,0x64 irq 1 Serial: 8250/16550 driver $Revision: 1.90 $ 8 ports, IRQ sharing disabled ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered Floppy drive(s): fd0 is 1.44M FDC 0 is a post-1991 82077 RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize loop: loaded (max 8 devices) Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2 ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx spurious 8259A interrupt: IRQ7. VP_IDE: IDE controller at PCI slot 0000:00:07.1 VP_IDE: chipset revision 6 VP_IDE: not 100% native mode: will probe irqs later VP_IDE: VIA vt82c686b (rev 40) IDE UDMA100 controller on pci0000:00:07.1 ide0: BM-DMA at 0xd800-0xd807, BIOS settings: hda:DMA, hdb:DMA ide1: BM-DMA at 0xd808-0xd80f, BIOS settings: hdc:DMA, hdd:pio Probing IDE interface ide0... hda: Maxtor 6Y080L0, ATA DISK drive hdb: HL-DT-ST GCE-8481B, ATAPI CD/DVD-ROM drive ide0 at 0x1f0-0x1f7,0x3f6 on irq 14 Probing IDE interface ide1... hdc: HL-DT-STDVD-ROM GDR8163B, ATAPI CD/DVD-ROM drive ide1 at 0x170-0x177,0x376 on irq 15 Probing IDE interface ide2... Probing IDE interface ide3... Probing IDE interface ide4... Probing IDE interface ide5... hda: max request size: 128KiB hda: 160086528 sectors (81964 MB) w/2048KiB Cache, CHS=65535/16/63, UDMA(33) hda: cache flushes supported /dev/ide/host0/bus0/target0/lun0: p1 p2 p3 p4 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 > hdb: ATAPI 40X CD-ROM CD-R/RW drive, 2048kB Cache, UDMA(33) Uniform CD-ROM driver Revision: 3.20 hdc: ATAPI 52X DVD-ROM drive, 256kB Cache, UDMA(33) libata version 1.10 loaded. mice: PS/2 mouse device common for all mice input: AT Translated Set 2 keyboard on isa0060/serio0 psmouse.c: Failed to reset mouse on isa0060/serio1 input: PS/2 Generic Mouse on isa0060/serio1 psmouse.c: Failed to enable mouse on isa0060/serio1 md: linear personality registered as nr 1 md: raid0 personality registered as nr 2 md: raid1 personality registered as nr 3 md: raid10 personality registered as nr 9 md: raid5 personality registered as nr 4 raid5: measuring checksumming speed 8regs : 1080.000 MB/sec 8regs_prefetch: 1020.000 MB/sec 32regs : 812.000 MB/sec 32regs_prefetch: 764.000 MB/sec pII_mmx : 2168.000 MB/sec p5_mmx : 2904.000 MB/sec raid5: using function: p5_mmx (2904.000 MB/sec) raid6: int32x1 332 MB/s raid6: int32x2 410 MB/s raid6: int32x4 265 MB/s raid6: int32x8 253 MB/s raid6: mmxx1 675 MB/s raid6: mmxx2 1136 MB/s raid6: sse1x1 644 MB/s raid6: sse1x2 1058 MB/s raid6: using algorithm sse1x2 (1058 MB/s) md: raid6 personality registered as nr 8 md: multipath personality registered as nr 7 md: md driver 0.90.1 MAX_MD_DEVS=256, MD_SB_DISKS=27 device-mapper: 4.4.0-ioctl (2005-01-12) initialised: firstname.lastname@example.org NET: Registered protocol family 2 IP: routing cache hash table of 2048 buckets, 32Kbytes TCP established hash table entries: 16384 (order: 6, 262144 bytes) TCP bind hash table entries: 16384 (order: 5, 196608 bytes) TCP: Hash tables configured (established 16384 bind 16384) NET: Registered protocol family 1 NET: Registered protocol family 10 IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 ACPI wakeup devices: PCI0 PCI1 UAR1 UAR2 USB0 USB1 ACPI: (supports S0 S1 S4 S5) devfs_mk_dev: could not append to parent for md/0 md: Autodetecting RAID arrays. md: autorun ... md: ... autorun DONE. ReiserFS: hda5: found reiserfs format "3.6" with standard journal ReiserFS: hda5: using ordered data mode ReiserFS: hda5: journal params: device hda5, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max t rans age 30 ReiserFS: hda5: checking transaction log (hda5) ReiserFS: hda5: Using r5 hash to sort names VFS: Mounted root (reiserfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 288k freed Adding 96380k swap on /dev/discs/disc0/part3. Priority:-1 extents:1 Adding 96348k swap on /dev/discs/disc0/part10. Priority:-2 extents:1 kjournald starting. Commit interval 5 seconds EXT3 FS on hda2, internal journal EXT3-fs: mounted filesystem with ordered data mode. ReiserFS: hda6: found reiserfs format "3.6" with standard journal ReiserFS: hda6: using ordered data mode ReiserFS: hda6: journal params: device hda6, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max t rans age 30 ReiserFS: hda6: checking transaction log (hda6) ReiserFS: hda6: Using r5 hash to sort names ReiserFS: hda7: found reiserfs format "3.6" with standard journal ReiserFS: hda7: using ordered data mode ReiserFS: hda7: journal params: device hda7, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max t rans age 30 ReiserFS: hda7: checking transaction log (hda7) ReiserFS: hda7: Using r5 hash to sort names ReiserFS: hda8: found reiserfs format "3.6" with standard journal ReiserFS: hda8: using ordered data mode ReiserFS: hda8: journal params: device hda8, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max t rans age 30 ReiserFS: hda8: checking transaction log (hda8) ReiserFS: hda8: Using r5 hash to sort names ReiserFS: hda9: found reiserfs format "3.6" with standard journal ReiserFS: hda9: using ordered data mode ReiserFS: hda9: journal params: device hda9, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max t rans age 30 ReiserFS: hda9: checking transaction log (hda9) ReiserFS: hda9: Using r5 hash to sort names Real Time Clock Driver v1.12 8139too Fast Ethernet driver 0.9.27 ACPI: PCI Interrupt Link [LNKB] enabled at IRQ 10 PCI: setting IRQ 10 as level-triggered ACPI: PCI interrupt 0000:00:0e.0[A] -> GSI 10 (level, low) -> IRQ 10 eth0: RealTek RTL8139 at 0xded90000, 00:50:fc:cd:88:dd, IRQ 10 eth0: Identified 8139 chip type 'RTL-8100B/8139D' Forcing 10Mbps half-duplex operation. ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 9 PCI: setting IRQ 9 as level-triggered ACPI: PCI interrupt 0000:00:07.5[C] -> GSI 9 (level, low) -> IRQ 9 PCI: Setting latency timer of device 0000:00:07.5 to 64 usbcore: registered new driver usbfs usbcore: registered new driver hub Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. USB Universal Host Controller Interface driver v2.2 ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 9 ACPI: PCI interrupt 0000:00:07.2[D] -> GSI 9 (level, low) -> IRQ 9 uhci_hcd 0000:00:07.2: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller uhci_hcd 0000:00:07.2: irq 9, io base 0xd400 uhci_hcd 0000:00:07.2: new USB bus registered, assigned bus number 1 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ACPI: PCI interrupt 0000:00:07.3[D] -> GSI 9 (level, low) -> IRQ 9 uhci_hcd 0000:00:07.3: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller (#2) uhci_hcd 0000:00:07.3: irq 9, io base 0xd000 uhci_hcd 0000:00:07.3: new USB bus registered, assigned bus number 2 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usb 1-2: new low speed USB device using uhci_hcd and address 2 usbcore: registered new driver hiddev usb 2-2: new full speed USB device using uhci_hcd and address 2 scsi0 : SCSI emulation for USB Mass Storage devices usb-storage: device found at 2 usb-storage: waiting for device to settle before scanning input: USB HID v1.10 Mouse [Logitech USB Mouse] on usb-0000:00:07.2-2 usbcore: registered new driver usbhid drivers/usb/input/hid-core.c: v2.0:USB HID core driver Disabled Privacy Extensions on device c05d68a0(lo) Vendor: USB MASS Model: STORAGE DEVICE Rev: 0.10 Type: Direct-Access ANSI SCSI revision: 02 Attached scsi removable disk sda at scsi0, channel 0, id 0, lun 0 usb-storage: device scan complete eth0: no IPv6 routers present
I was about to suggest where that extra 10MB could have come from, but then I realized your /var is on a different partition. heh
anyway, your du command is checking the disk usage of directories that aren't actually stored in your /. have a look at /etc/fstab ... some of those directories are dealt with by software or the kernel itself.
/tmp is a ram drive
/dev is taken care of devfsd or udevd, depending
/proc and /sys is basically information about your computer provided by the kernel. you'll notice /proc is 481MB ... your partition isn't even that big!
du and df output will vary, but not by too much (the difference seems to be about 5% on my computer ... i believe du accounts for block size, and df doesn't)
I knew about /proc /dev and /tmp under Arch. I just du-ed all the directories in the / partition that were not situated on separate partitions.
What I was trying to point out was actually this difference between du
2.8 bin + 5.5 etc + 64 lib +12 root + 5.2 sbin = 89.5M
Size Used Avail Use% Mounted on 189M 121M 68M 65% /
I.e. 5% of 121M is 6.05M, while 121M-89.5M=31.5M... that's WAY higher than 5% :!:
As for the cause of unexpected increase usage of the / filesystem...
Nobody knows what could the cause/s be? (This machine is behind a firewall and does not accept inbound ssh connections...) :?
Pwease... pweatty pwease... :cry:
Reiserfs uses about 32 Mb for its journal.
Ah! That should explain the du/df difference of ~31.5M.
So... one question down, one still hanging up in the air...
You mean 1? Anything could have happened, how should we know where that 10 Mb comes from? If the pc was turned off between the two check, then yes, something strange is going on, though if you didn't save the out put I'm inclinded to distrust your memory. If the thing was running between the two checks anything could be it, varying from browser cache data increase to a cronjob like updatedb, or even you installing or downloading something.
its down to witchcraft. burn your pc immediately
The PC was indeed turned off between the two checks.
However the first check was not performed right before the shutdown, but few hours before it.
(...) varying from browser cache data increase to a cronjob like updatedb, or even you installing or downloading something.
When I've read these words I have started to "scroll" back in my memory buffer and eventually I've remembered that the only thing I did as superuser was to download some Firefox extensions which (surprise or not...) summed up to ~12M.
So we have the answer for this one too thanks to your hints
PS: That's exactly the reason why I've made a small / partition - to keep a close eye on it's usage and to ring some allarms when needed.
Again, thank you.