my slice fill up with files

[vlad2005]

Hi!
I have an strange situation. With "df -h", i see that my slice, monted on /var, have occupied space that increase every day.
But when i give "du -c -sh -L /var", i see another size, and grow more slowly.
Where are these files?

#df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/ad0s1a 496M 242M 214M 53% /
devfs 1.0K 1.0K 0B 100% /dev
/dev/ad0s1e 496M 264K 456M 0% /tmp
/dev/ad0s1f 68G 4.8G 58G 8% /usr
/dev/ad0s1d 1.8G 1.1G 586M 65% /var
devfs 1.0K 1.0K 0B 100% /var/named/dev



#du -c -sh -L /var
457M /var
457M total

Space occupied by /var are 1.1G show by df and 457M show by du.

[schizoid]

http://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/disks.html#DU-VS-DF - ?

[vlad2005]

ok, i restart my server, and now, df look ok and show same size like du.
But for future, how can resolve that, without restart server.
I restart all my daemons, before restarting server, without success.

[Lowell]

You can use fstat(1) to find out what process is holding an open file handle on /var. How you get the process to close the file handle depends on what application is running in that process.

[gelraen]

ok, i restart my server, and now, df look ok and show same size like du.
But for future, how can resolve that, without restart server.
I restart all my daemons, before restarting server, without success.
You can try to run sync(8) few times if problem caused by softupdates delay.

[schizoid]

i to have this bug.
when i restarting natd, df == du

[keramida@]

Hi!
I have an strange situation. With "df -h", i see that my slice, monted on /var, have occupied space that increase every day. [...]
Space occupied by /var are 1.1G show by df and 457M show by du.

This is commonly caused by a daemon keeping a log file open after it has been rotated away. You can find which program has open files in /var with a variety of tools: fstat(1) in the base system, and lsof(1) from the ports are nice.

In newer FreeBSD releases (i.e. in FreeBSD 7-STABLE) you can also use the procstat(1) utility that Robert Watson wrote:

# procstat -fa | fgrep var/log
623 pflogd 4 v r rwa--n-- 1 46984 - /var/log/pflog
1410 syslogd 13 v r -wa----- 1 61863 - /var/log/messages
1410 syslogd 14 v r -wa----- 1 0 - /var/log/security
1410 syslogd 15 v r -wa----- 1 0 - /var/log/auth.log
1410 syslogd 16 v r -wa----- 1 77482 - /var/log/maillog
1410 syslogd 17 v r -wa----- 1 0 - /var/log/lpd-errs
1410 syslogd 18 v r -wa----- 1 0 - /var/log/xferlog
1410 syslogd 19 v r -wa----- 1 2876 - /var/log/cron
1410 syslogd 20 v r -wa----- 1 4849 - /var/log/debug.log
1410 syslogd 21 v r -wa----- 1 0 - /var/log/ppp.log
#