1

I was copying a large VM disk file to a separate larger separate disk array to work on it and during a benchmark I did previously before I started the copy job I didn't realize that the benchmark had unmounted the array. So the file was partially copied to somewhere within the / filesystem and I cannot find it anywhere. I've looked with some commands like find -type f -exec du -Sh {} + | sort -rh | head -n 5 to the find the largest files. Any suggestions? Below are the file system outputs.

df -h
Filesystem               Size  Used Avail Use% Mounted on
/dev/mapper/centos-root   50G   50G  122M 100% /
devtmpfs                  16G     0   16G   0% /dev
tmpfs                     16G     0   16G   0% /dev/shm
tmpfs                     16G   11M   16G   1% /run
tmpfs                     16G     0   16G   0% /sys/fs/cgroup
/dev/sda2               1014M  216M  799M  22% /boot
/dev/sda1                200M   12M  189M   6% /boot/efi
/dev/mapper/centos-home  864G  301G  563G  35% /home
tmpfs                    3.1G   32K  3.1G   1% /run/user/1000
/dev/sdb1                1.9T  132G  1.7T   8% /disk1


du -sh *
0       bin
194M    boot
0       dev
46G     disk1
41M     etc
301G    home
0       lib
0       lib64
0       media
0       mnt
720K    opt
du: cannot access ‘proc/39152/task/39152/fd/3’: No such file or directory
du: cannot access ‘proc/39152/task/39152/fdinfo/3’: No such file ordirectory
du: cannot access ‘proc/39152/fd/3’: No such file or directory
du: cannot access ‘proc/39152/fdinfo/3’: No such file or directory
0       proc
4.9M    root
du: cannot access ‘run/user/1000/gvfs’: Permission denied
11M     run
0       sbin
0       srv
0       sys
20M     tmp
3.5G    usr
673M    var
Matthew Kelly
  • 11
  • Your output is nearly useless (you only show one file system, not all mounted ones and we can't make out the type of the entries in your list. Check what disk1 is, this is a strange name not normally found in /. – Sven Sep 21 '18 at 17:27
  • disk1 is a second raid array with the identifier sdb1 and the mount point of /disk1. Under df -h centos-root is 100% full after the failed move like I said and /disk1 is is 8% with centos-home at 35%. I updated the main post to show all the filsystems if that helps. – Matthew Kelly Sep 21 '18 at 18:12
  • Note that /dev/mapper/centos-root == / but != /root although / is called the ”root file system/partition” it contains more than the /root directory – HBruijn Sep 21 '18 at 18:22
  • Yes, it contains /root, /etc, /run among others. /home is a separate partition and /disk1 is an entirely different disk array. I'm trying to find what I assume is a half moved vhdx file that wound up in / when it filled up after running the command the first time because of my mistake but I can't find any such file currently which leaves me wondering why that partition filled up and what filled it up since /disk1 is not included in it and is now larger than 700GB after I corrected my mistake. – Matthew Kelly Sep 21 '18 at 18:48
  • You could relative easily find the largest files in any partition with a singleline script. For example (I did not test it): find /mount/point -type f -print 0|xargs -P 1 -n 500 ls -l|sort -n -k +5 -r|head -20. About your question, I would suggest to try to make it more specific, best if the answerers can see already from its title, what you want. If you ask a question, tune it always to the time of the answerer. If your problem don't get a reopen, you might also try https://unix.stackexchange.com . If it is reopened, you are not allowed to cross-post. It will be decided in roughly a day. – peterh Sep 21 '18 at 18:55
  • Thank you for the help :) I did actually try to use a similar find command that does the things as the one listed does and that's why I'm confused basically. All of the files that I can find are in /disk1 which isn't part of /, it can't be because /disk1 is over 700GB now with things i've been doing it in. Only things larger than 100M in side of the subfolders of / are 146M in /var/lib/rpm/Packages and 102M in /usr/lib/locale – Matthew Kelly Sep 21 '18 at 19:15
  • The new disk array was unmounted during the benchmark I did which I didn't realize and when I started the file copy and it just partially copied the file to the folder I made inside of / as the mount point and filled up the space for /. It wasn't visible or even showing up in any command that would find the largest files in the file-system because the disk array was remounted over top of it. So after I unmounted it on purpose again to fix something I was able to find and delete it. – Matthew Kelly Sep 25 '18 at 18:23

1 Answers1

2

You have 46G on /disk1, so unless that is another partition, that seems the place to look.

When I want to know where most of the space is used,I use this command:

du -Sx / | sort -n

If the used space isn't visible to du, then it belongs to a deleted file that is still open in some process. You can use lsof to look for open files, especially for deleted files.

lsof -nP | grep deleted
RalfFriedl
  • 3,148